Disable or Modify Local Security Tools

Adversaries may attempt to disable, degrade, or tamper with host security tools to impair defensive visibility. This entry covers high-level Windows security-policy and service-state tampering behavior only. The outcome depends on Windows version, Microsoft Defender platform, Tamper Protection, and endpoint management; an attempted change does not establish that protection was disabled.