AV Service Stopped via Remote Service Control

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects attempts to stop the Microsoft Defender Antivirus service (MsMpEng) remotely via the Server Message Block (SMB) protocol on port 445. The detection is triggered by the presence of "StopService" and "MsMpEng" (case-insensitive) within the TCP payload, indicating a potential defense evasion tactic.