SeDebugPrivilege escalation followed by TerminateProcess of AV processes

Kaung Khant Ko@kaungkhantko

•updated Sep 8, 2026•1•0•3

This rule detects the termination of critical security software processes (e.g., antivirus agents) by a process that has recently acquired SeDebugPrivilege. This behavior is indicative of a malicious actor attempting to disable endpoint security controls to evade detection.