Suspicious Removal of Windows Defender Context Menu (via process_creation)

This rule detects the use of reg.exe or PowerShell to delete the Windows Defender context menu handler registry keys. This action removes the "Scan with Microsoft Defender" option from the right-click menu for files, directories, and drives. Attackers may use this method to hinder manual, on-demand scans and reduce the visibility of the security product.