Potential Tampering With Security Products Via WMIC
Detects attempts to uninstall or terminate security products using the Windows Management Instrumentation Command-line (WMIC) utility. Adversaries often disable or remove security software to evade detection and facilitate their malicious activities. This rule specifically looks for WMIC commands that target common security product names and attempt to uninstall or terminate them.
Sigma
