Sysinternals PsSuspend Suspicious Execution

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2026•0•0•3

Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as AV or EDR to bypass defenses