The Gentlemen RaaS: Rapid Security Tool Disablement (T1562.001)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects multiple distinct attempts to tamper with security products on a host. It identifies processes attempting to stop security-related services (via sc.exe or net.exe), processes attempting to kill security-related applications (via taskkill.exe), modifications to Windows Defender registry keys, or the use of PowerShell Set-MpPreference to disable security features. The rule triggers when two or more of these evasion events or types occur within a 5-minute window on the same host.