Reynolds Ransomware EDR/AV Process Termination via NSecKrnl Kernel Driver
Detects Reynolds ransomware terminating hardcoded EDR/AV process names via its NSecKrnl kernel driver. The rule identifies process terminations of known security software executables and correlates it with the presence of the '402.sys' driver in the 'C:\ProgramData' folder, which is associated with the NSecKrnl driver used by Reynolds ransomware.
Microsoft Sentinel (KQL)
