((Image:\\reg.exe OR OriginalFileName:reg.exe) (CommandLine:SOFTWARE\\Microsoft\\Windows\ Defender\\* OR CommandLine:SOFTWARE\\Policies\\Microsoft\\Windows\ Defender\ Security\ Center* OR CommandLine:SOFTWARE\\Policies\\Microsoft\\Windows\ Defender\\*)) (((CommandLine:\ add\ * CommandLine:d\ 0*) (CommandLine:DisallowExploitProtectionOverride* OR CommandLine:EnableControlledFolderAccess* OR CommandLine:MpEnablePus* OR CommandLine:PUAProtection* OR CommandLine:SpynetReporting* OR CommandLine:SubmitSamplesConsent* OR CommandLine:TamperProtection*)) OR ((CommandLine:\ add\ * CommandLine:d\ 1*) (CommandLine:DisableAccess* OR CommandLine:DisableAntiSpyware* OR CommandLine:DisableAntiSpywareRealtimeProtection* OR CommandLine:DisableAntiVirus* OR CommandLine:DisableAntiVirusSignatures* OR CommandLine:DisableArchiveScanning* OR CommandLine:DisableBehaviorMonitoring* OR CommandLine:DisableBlockAtFirstSeen* OR CommandLine:DisableCloudProtection* OR CommandLine:DisableConfig* OR CommandLine:DisableEnhancedNotifications* OR CommandLine:DisableIntrusionPreventionSystem* OR CommandLine:DisableIOAVProtection* OR CommandLine:DisableNetworkProtection* OR CommandLine:DisableOnAccessProtection* OR CommandLine:DisablePrivacyMode* OR CommandLine:DisableRealtimeMonitoring* OR CommandLine:DisableRoutinelyTakingAction* OR CommandLine:DisableScanOnRealtimeEnable* OR CommandLine:DisableScriptScanning* OR CommandLine:DisableSecurityCenter* OR CommandLine:Notification_Suppress* OR CommandLine:SignatureDisableUpdateOnStartupWithoutEngine*)))