Sysmon Service Tampering via sc.exe, taskkill, or PowerShell

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects attempts to stop, disable, delete, or configure the Sysmon service using standard administrative utilities (sc.exe, taskkill.exe, or PowerShell). Attackers often perform these actions to blind defensive visibility before executing further malicious activity.