File or Resource Lock Held to Block Defender Access

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects attempts to block defender access by holding a file or resource lock. Specifically, it looks for TCP traffic on port 445 (SMB) containing the string "LockFile" in a case-insensitive manner. A threshold of 10 occurrences within 10 seconds from the same source IP is set to trigger an alert, indicating potential malicious activity aimed at hindering security software.