Disable or Modify Windows Defender

Threat behavior involves attempts to impair Microsoft Defender Antivirus by changing protection state or exclusions. This entry retains read-only product, status, and exclusion checks and describes modification behavior only at a high level. Any assessment must be explicitly authorized, limited to a designated test endpoint and approved change window, performed through the system-owner-approved management process, and have a rollback owner. A local status or exclusion listing does not establish central policy ownership, effective enforcement, or sensor health.