Security Tool Tampering via Service Stop/Delete or Defender Bypass

Ibrahim Saud@tektrix

•updated 9 days ago•1•0•1

Detects attempts to disable, stop, or reconfigure security software (Antivirus, EDR, Endpoint Protection) on Windows endpoints by abusing legitimate administrative utilities such as sc.exe, net.exe, taskkill.exe, wmic.exe, and PowerShell to tamper with service configurations or kill security-related processes.