Security Software Enumeration Chained with Service Stop/Disable (T1518)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects a sequence of actions where a process first enumerates security software (e.g., via WMIC, Registry, or PowerShell) followed by an attempt to stop or terminate security-related services or processes within a short timeframe (5 minutes). This pattern is indicative of an adversary attempting to identify and disable endpoint protection before executing further malicious activity.