EDR / Antivirus Tampering (Service Stop, Uninstall, Tamper Protection Disable)

Ankit Mehta@Secvyn

•updated Aug 10, 2026•10•2•15

This rule detects attempts to disable, stop, or uninstall various security products, including antivirus and EDR solutions, by monitoring command-line activity for administrative utilities like sc.exe, net.exe, wmic.exe, and PowerShell.