Continuous Toolhelp32-style process scan targeting hard-coded AV/EDR list from unsigned/non-system processes
Detects high-frequency enumeration of hard-coded AV/EDR process names via repeated OpenProcess API calls from an initiating process that is unsigned or running outside standard Windows system directories.
Microsoft Sentinel (KQL)
