i.bat Defense Impairment: Defender, Sysmon, Filebeat, ModSecurity Disabled

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects the execution of 'i.bat' script accompanied by subsequent commands intended to exhaustively impair security defenses on a Windows host. The rule identifies the combination of the script execution and targeted commands to disable Microsoft Defender, stop Sysmon/Filebeat services, and uninstall or misconfigure ModSecurity modules.