EDR Killer — Process Termination/Suspension Targeting Security Agents (T1562.001)

Ankit Mehta@Secvyn

•updated Jun 27, 2026•3•0•4

Detects unauthorized attempts to terminate, stop, or access Endpoint Detection and Response (EDR) or Antivirus agent processes. This is identified by monitoring command-line utilities like taskkill, net, and sc targeting known security service names, as well as detecting suspicious cross-process access (e.g., OpenProcess) by unauthorized processes targeting security agent PIDs.