Investigation Scenario 🔎 Windows Defender Event ID 5007 shows DisableRealtimeMonitoring changed from 0 to 1, yet MsMpEng.exe appears to still be running. What do you look for to investigate whether an incident occurred? #InvestigationPath #DFIR #SOC