Potential Defense Evasion via Service/EventLog Manipulation from Explorer.exe

nomit vyas@xoxo

•updated Jun 22, 2026•3•0•8

This rule detects attempts to stop security services (like Windows Defender) or clear event logs using 'sc stop', 'net stop', or 'wevtutil cl' commands, specifically when initiated by 'explorer.exe'. This behavior, especially when originating from explorer.exe, can indicate an adversary attempting to impair defenses or remove forensic evidence.