In all likelihood they aren't targeting this specifically, software messing with system internals, turning off Antivirus, ... is going to trigger rules looking for malware doing that.