i.bat Defence Impairment: Defender, Sysmon, and Filebeat Disabled

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the systematic disabling or termination of security products and auditing tools on Windows systems, including Microsoft Defender, Sysmon, Filebeat, and WAF logging services. The rule triggers on process execution patterns associated with command-line tampering, service control manager manipulation, registry modifications, and the execution of specific batch scripts designed to impair defenses.