Security Tool Process Kill-Loop

nomit vyas@xoxo

•updated Jun 23, 2026•1•0•10

Detects a rapid, repeated termination of known security tool processes within a short time frame. This behavior is indicative of an "EDR killer" malware attempting to disable security controls in a continuous loop.