i.bat Defence Impairment: Defender, Sysmon, Filebeat, ModSecurity Disabled

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the execution of batch files that perform multiple actions to impair or disable security tools, including Windows Defender, Sysmon, Filebeat, and IIS logging components. The rule monitors for a pattern of suspicious process commands (stop, config, delete, kill, Set-MpPreference) originating from a .bat file, flagging hosts where two or more distinct impairment actions are executed by the same parent process.