Security Tool Disable Command via HTTP

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects HTTP traffic where the URI contains both 'disable' and 'defender' (case-insensitive). This pattern suggests an attempt to disable security tools, specifically Windows Defender, via an HTTP command. The flow is set to 'to_client,established', indicating the response from a server to a client within an established connection.