Security Services Disabled via SC.EXE
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Microsoft Sentinel (KQL)
