Ransomware Series: Nova Ransomware WinDefend Service Stop and Disable via sc.exe

Ibrahim Saud@tektrix

•updated 11 days ago•1•0•1

Detects the use of the sc.exe command-line utility to stop or disable the Microsoft Defender Antivirus service (WinDefend). This activity is often associated with ransomware, such as Nova ransomware, to bypass security controls prior to malicious encryption or data destruction.