diff --git a/detections/endpoint/windows_impair_defense_disable_pua_protection.yml b/detections/endpoint/windows_impair_defense_disable_pua_protection.yml
deleted file mode 100644
index 4f548d3001..0000000000
--- a/detections/endpoint/windows_impair_defense_disable_pua_protection.yml
+++ /dev/null
@@ -1,73 +0,0 @@
-name: Windows Impair Defense Disable PUA Protection
-id: fbfef407-cfee-4866-88c1-f8de1c16147c
-version: 1
-date: '2024-01-08'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-data_source:
-- Sysmon Event ID 12
-- Sysmon Event ID 13
-- Sysmon Event ID 14
-description: The following analytic identifies a modification in the Windows registry to disable Windows Defender 
-  PUA protection.
-  Setting PUAProtection to 0 typically disables the detection and protection against Potentially Unwanted Applications 
-  by Microsoft Defender Antivirus. Potentially Unwanted Applications include software that may not be inherently 
-  malicious but could exhibit behaviors that users may find undesirable, such as adware, browser toolbars, or software bundlers.
-  Disabling this feature might be preferred in certain situations, but it's essential to consider potential security implications. 
-  Enabling PUA protection provides an additional layer of defense against software that might negatively impact user experience 
-  or security.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\PUAProtection"
-  Registry.registry_value_data="0x00000000"
-  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `windows_impair_defense_disable_pua_protection_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node.
-known_false_positives: It is unusual to turn this feature off a Windows system since
-  it is a default security control, although it is not rare for some policies to disable
-  it. Although no false positives have been identified, use the provided filter macro
-  to tune the search.
-references:
-- https://x.com/malmoeb/status/1742604217989415386?s=20
-- https://github.com/undergroundwires/privacy.sexy
-tags:
-  analytic_story:
-  - Windows Defense Evasion Tactics
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 70
-  impact: 70
-  message: Windows Defender PUA protection set to disable on $dest$.
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 49
-  required_fields:
-  - _time
-  - Registry.registry_key_name
-  - Registry.registry_value_name
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_path
-  - Registry.action
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
diff --git a/detections/endpoint/windows_impair_defense_disable_realtime_signature_delivery.yml b/detections/endpoint/windows_impair_defense_disable_realtime_signature_delivery.yml
deleted file mode 100644
index 9a3e3df631..0000000000
--- a/detections/endpoint/windows_impair_defense_disable_realtime_signature_delivery.yml
+++ /dev/null
@@ -1,71 +0,0 @@
-name: Windows Impair Defense Disable Realtime Signature Delivery
-id: ffd99aea-542f-448e-b737-091c1b417274
-version: 1
-date: '2024-01-08'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-data_source:
-- Sysmon Event ID 12
-- Sysmon Event ID 13
-- Sysmon Event ID 14
-description: The following analytic identifies a modification in the Windows registry to disable windows defender 
-  realtime signature delivery feature. This setting governs how Windows Defender Antivirus receives updated signature 
-  definitions for identifying and combating malware threats in real-time. The actual impact and behaviors associated 
-  with different values for RealtimeSignatureDelivery can vary based on specific Windows Defender configurations and policies.
-  For instance, setting this value to 0 or 1 might control whether real-time signatures are delivered via different methods 
-  such as through Windows Update or directly from Microsoft's cloud-based services.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Signature Updates\\RealtimeSignatureDelivery"
-  Registry.registry_value_data="0x00000000" 
-  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `windows_impair_defense_disable_realtime_signature_delivery_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node.
-known_false_positives: It is unusual to turn this feature off a Windows system since
-  it is a default security control, although it is not rare for some policies to disable
-  it. Although no false positives have been identified, use the provided filter macro
-  to tune the search.
-references:
-- https://x.com/malmoeb/status/1742604217989415386?s=20
-- https://github.com/undergroundwires/privacy.sexy
-tags:
-  analytic_story:
-  - Windows Defense Evasion Tactics
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 70
-  impact: 70
-  message: Windows Defender File realtime signature delivery set to disable on $dest$.
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 49
-  required_fields:
-  - _time
-  - Registry.registry_key_name
-  - Registry.registry_value_name
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_path
-  - Registry.action
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
diff --git a/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml b/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml
deleted file mode 100644
index f5e186b69c..0000000000
--- a/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml
+++ /dev/null
@@ -1,75 +0,0 @@
-name: Windows Impair Defense Disable Web Evaluation
-id: e234970c-dcf5-4f80-b6a9-3a562544ca5b
-version: 1
-date: '2024-01-08'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-data_source:
-- Sysmon Event ID 12
-- Sysmon Event ID 13
-- Sysmon Event ID 14
-description: The following analytic identifies a modification in the Windows registry to disable Windows Defender 
-  web content evaluation. The "EnableWebContentEvaluation" registry entry typically relates to security settings 
-  within Microsoft Edge or Internet Explorer, enabling the evaluation of web content for security purposes.
-  When attackers modify "EnableWebContentEvaluation" to 0, they might attempt to disable the browser's 
-  capability to evaluate web content for security purposes. Disabling this feature could potentially impact 
-  the browser's ability to assess the security risks associated with web content, such as potentially malicious scripts, 
-  active content, or unsafe web elements.
-  By turning off content evaluation, attackers might aim to exploit security vulnerabilities present in web content without 
-  triggering security warnings or blocks. This manipulation increases the risk of users accessing or interacting with malicious 
-  content, potentially leading to security compromises or system exploitation.
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
-  WHERE Registry.registry_path= "*\\Windows\\CurrentVersion\\AppHost\\EnableWebContentEvaluation"  Registry.registry_value_data= "0x00000000" 
-  BY _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name
-  Registry.registry_value_data Registry.process_guid 
-  | `drop_dm_object_name(Registry)`
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `windows_impair_defense_disable_web_evaluation_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node.
-known_false_positives: It is unusual to turn this feature off a Windows system since
-  it is a default security control, although it is not rare for some policies to disable
-  it. Although no false positives have been identified, use the provided filter macro
-  to tune the search.
-references:
-- https://x.com/malmoeb/status/1742604217989415386?s=20
-- https://github.com/undergroundwires/privacy.sexy
-tags:
-  analytic_story:
-  - Windows Defense Evasion Tactics
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 70
-  impact: 70
-  message: Windows Defender web content evaluation feature set to disable on $dest$.
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 49
-  required_fields:
-  - _time
-  - Registry.registry_key_name
-  - Registry.registry_value_name
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_path
-  - Registry.action
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_app_guard.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_app_guard.yml
deleted file mode 100644
index 9bb1798e94..0000000000
--- a/detections/endpoint/windows_impair_defense_disable_win_defender_app_guard.yml
+++ /dev/null
@@ -1,74 +0,0 @@
-name: Windows Impair Defense Disable Win Defender App Guard
-id: 8b700d7e-54ad-4d7d-81cc-1456c4703306
-version: 1
-date: '2024-01-08'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-data_source:
-- Sysmon Event ID 12
-- Sysmon Event ID 13
-- Sysmon Event ID 14
-description: The following analytic identifies a modification in the Windows registry to disable Windows Defender 
-  audit application guard.
-  Microsoft Defender Application Guard provides enhanced security by isolating potentially malicious documents and 
-  websites in a containerized environment, protecting the system against various threats. Auditing and logging are 
-  essential components of security measures, providing visibility into activities within the isolated environment.
-  Disabling auditing events within Application Guard might not be a standard or recommended practice since auditing 
-  is crucial for security monitoring and threat detection within the isolated container. However, there might be 
-  settings or configurations related to audit policies in the broader Windows Defender or operating system settings.
-  This registry setting is being abuse by several threat actors, adversaries and red teamers to bypasses Windows defender detections.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Policies\\Microsoft\\AppHVSI\\AuditApplicationGuard"
-  Registry.registry_value_data="0x00000000"
-  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `windows_impair_defense_disable_win_defender_app_guard_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node.
-known_false_positives: It is unusual to turn this feature off a Windows system since
-  it is a default security control, although it is not rare for some policies to disable
-  it. Although no false positives have been identified, use the provided filter macro
-  to tune the search.
-references:
-- https://x.com/malmoeb/status/1742604217989415386?s=20
-- https://github.com/undergroundwires/privacy.sexy
-tags:
-  analytic_story:
-  - Windows Defense Evasion Tactics
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 70
-  impact: 70
-  message: Windows Defender AuditApplicationGuard feature set to disable on $dest$.
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 49
-  required_fields:
-  - _time
-  - Registry.registry_key_name
-  - Registry.registry_value_name
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_path
-  - Registry.action
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_compute_file_hashes.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_compute_file_hashes.yml
deleted file mode 100644
index ad16f6027d..0000000000
--- a/detections/endpoint/windows_impair_defense_disable_win_defender_compute_file_hashes.yml
+++ /dev/null
@@ -1,70 +0,0 @@
-name: Windows Impair Defense Disable Win Defender Compute File Hashes
-id: fe52c280-98bd-4596-b6f6-a13bbf8ac7c6
-version: 1
-date: '2024-01-08'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-data_source:
-- Sysmon Event ID 12
-- Sysmon Event ID 13
-- Sysmon Event ID 14
-description: The following analytic identifies a modification in the Windows registry to disable Windows Defender file hashes computation.
-  The EnableFileHashComputation registry setting likely pertains to whether Windows Defender's MpEngine (Malware Protection Engine) computes 
-  file hashes. Setting this value to 0 might disable the file hash computation feature within Windows Defender, which could affect certain 
-  malware detection or scanning functionalities that rely on file hash analysis. This registry setting is being abuse by several threat actors, adversaries 
-  and red teamers to bypasses Windows defender detections.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\MpEngine\\EnableFileHashComputation"
-  Registry.registry_value_data="0x00000000" 
-  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `windows_impair_defense_disable_win_defender_compute_file_hashes_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node.
-known_false_positives: It is unusual to turn this feature off a Windows system since
-  it is a default security control, although it is not rare for some policies to disable
-  it. Although no false positives have been identified, use the provided filter macro
-  to tune the search.
-references:
-- https://x.com/malmoeb/status/1742604217989415386?s=20
-- https://github.com/undergroundwires/privacy.sexy
-tags:
-  analytic_story:
-  - Windows Defense Evasion Tactics
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 70
-  impact: 70
-  message: Windows Defender File hashes computation set to disable on $dest$.
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 49
-  required_fields:
-  - _time
-  - Registry.registry_key_name
-  - Registry.registry_value_name
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_path
-  - Registry.action
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_gen_reports.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_gen_reports.yml
deleted file mode 100644
index a1cd201ebe..0000000000
--- a/detections/endpoint/windows_impair_defense_disable_win_defender_gen_reports.yml
+++ /dev/null
@@ -1,71 +0,0 @@
-name: Windows Impair Defense Disable Win Defender Gen reports
-id: 93f114f6-cb1e-419b-ac3f-9e11a3045e70
-version: 1
-date: '2024-01-08'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-data_source:
-- Sysmon Event ID 12
-- Sysmon Event ID 13
-- Sysmon Event ID 14
-description: The following analytic identifies a modification in the Windows registry to disable Windows Defender 
-  generic ports. This registry can disable the sending of Watson events in Windows Defender. This is by preventing 
-  the transmission of generic or non-specific error reports to Microsoft's Windows Error Reporting service, 
-  commonly known as Watson. This kind of setting could potentially be employed to limit or control the data sent to 
-  Microsoft for error analysis, often in scenarios where privacy or specific reporting requirements are in place.
-  This registry setting is being abuse by several threat actors, adversaries and red teamers to bypasses Windows defender detections. 
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Reporting\\DisableGenericRePorts"
-  Registry.registry_value_data="0x00000001"
-  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `windows_impair_defense_disable_win_defender_gen_reports_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node.
-known_false_positives: It is unusual to turn this feature off a Windows system since
-  it is a default security control, although it is not rare for some policies to disable
-  it. Although no false positives have been identified, use the provided filter macro
-  to tune the search.
-references:
-- https://x.com/malmoeb/status/1742604217989415386?s=20
-- https://github.com/undergroundwires/privacy.sexy
-tags:
-  analytic_story:
-  - Windows Defense Evasion Tactics
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 70
-  impact: 70
-  message: Windows Defender DisableGenericRePorts registry is set to enable on $dest$.
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 49
-  required_fields:
-  - _time
-  - Registry.registry_key_name
-  - Registry.registry_value_name
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_path
-  - Registry.action
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml
deleted file mode 100644
index 7377307d55..0000000000
--- a/detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml
+++ /dev/null
@@ -1,71 +0,0 @@
-name: Windows Impair Defense Disable Win Defender Network Protection
-id: 8b6c15c7-5556-463d-83c7-986326c21f12
-version: 1
-date: '2024-01-08'
-author: Teoderick Contreras, Splunk
-status: production
-type: TTP
-data_source:
-- Sysmon Event ID 12
-- Sysmon Event ID 13
-- Sysmon Event ID 14
-description: The following analytic identifies a modification in the Windows registry to disable Windows Defender 
-  exploit guard network protection. The EnableNetworkProtection registry entry controls the activation or deactivation 
-  of Network Protection within Windows Defender Exploit Guard. When set to 1, it typically signifies that Network Protection 
-  is enabled, offering additional security measures against network-based threats by analyzing and blocking potentially 
-  malicious network activity. This registry setting is being abuse by several threat actors, adversaries 
-  and red teamers to bypasses Windows defender detections.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Windows Defender Exploit Guard\\Network Protection\\EnableNetworkProtection"
-  Registry.registry_value_data="0x00000000" 
-  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `windows_impair_defense_disable_win_defender_network_protection_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node.
-known_false_positives: It is unusual to turn this feature off a Windows system since
-  it is a default security control, although it is not rare for some policies to disable
-  it. Although no false positives have been identified, use the provided filter macro
-  to tune the search.
-references:
-- https://x.com/malmoeb/status/1742604217989415386?s=20
-- https://github.com/undergroundwires/privacy.sexy
-tags:
-  analytic_story:
-  - Windows Defense Evasion Tactics
-  - Windows Registry Abuse
-  asset_type: Endpoint
-  confidence: 70
-  impact: 70
-  message: Windows Defender Exploit Guard network protection set to disable on $dest$.
-  mitre_attack_id:
-  - T1562.001
-  - T1562
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 49
-  required_fields:
-  - _time
-  - Registry.registry_key_name
-  - Registry.registry_value_name
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_path
-  - Registry.action
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog