i.bat-Style Mass Security Service Termination — 3+ Services in 60s Window

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects anomalous activity where a process or user attempts to stop or disable multiple security-related services (e.g., Windows Defender, Sysmon, EDR agents) within a short window. This behavior is indicative of an adversary attempting to impair defensive monitoring and protection tools during a compromise.