Security Service Disabled or Modified

An Le@nupagazi

•updated Jan 31, 2026•8•0•106

This query detects attempts to disable or modify critical security services using either the 'sc.exe' utility or direct registry modification. This is a common defense evasion technique used by adversaries to weaken a system's security posture before performing further actions.