CleanWipe Execution for Security Software Removal
This rule detects the execution of Symantec CleanWipe, a utility designed to remove Symantec antivirus products. Adversaries may use such tools to disable security software as part of their defense evasion tactics. The rule identifies CleanWipe by specific executable names and command-line arguments associated with its uninstallation functions.
Sigma
