Kaspersky avp.exe crash or unexpected termination (HardBreacher tampering)
Detects attempts to crash or terminate the Kaspersky Antivirus process (avp.exe), as well as associated events indicating the service has been stopped or is encountering abnormal fault conditions. This behavior is indicative of an adversary attempting to disable security software.
Microsoft Sentinel (KQL)
