Security Software Termination via taskkill, tskill, or net stop (T1562.001)

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•3

Detects attempts to terminate security-related processes or stop security services using common Windows command-line utilities such as taskkill, tskill, or the net stop command. This behavior is indicative of an adversary attempting to impair defensive measures on a compromised system.