Detects modification of Security Center AV registry keys under HKLM\Software\Microsoft\Security Center\Provider\Av, specifically changes to DisplayName, ProductEXE, or ReportingExe. The rule triggers when TargetObject contains the AV provider path and ends with one of the key values, indicating an attempt to alter the antivirus product information reported to Windows Security Center. To reduce false positives from legitimate AV updates, the rule excludes changes associated with a known antivirus process (running under svchost.exe) listed in filter_optional_antivirus. If a modification is observed that is not tied to a whitelisted antivirus, the rule raises a potential defense-evasion or tampering event intended to impair security visibility. False positives may occur for legitimate AV changes not covered by the whitelist. The rule is tagged for defense impairment and maps to ATT&CK technique references related to tampering with security product visibility (defense evasion).