Security Tool Process Kill-Loop Detection
Detects a rapid, repeated termination of known security tool processes within a short time frame. This behavior is indicative of an "EDR killer" malware attempting to disable security controls in a continuous loop.
Microsoft Sentinel (KQL)
