Sysinternals PsSuspend Suspicious Execution Targeting AV/EDR
Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as AV or EDR to bypass defenses. The rule specifically looks for the execution of 'pssuspend.exe' or 'pssuspend64.exe' with 'msmpeng.exe' in the command line, which is the executable for Microsoft Defender Antivirus.
Sigma
