Potential Defense Evasion via Service Stop or Security Tool Tampering

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•1

This rule detects attempts to stop services or tamper with security tools (Windows Defender, EventLog) using 'sc stop', 'net stop', 'wevtutil cl', 'Add-MpPreference', or 'Set-MpPreference' commands, specifically when initiated by 'explorer.exe'. This could indicate an adversary attempting to impair defenses or achieve persistence.