Taskkill/sc.exe Terminating or Deleting EDR and Security Software Processes
Detects attempts to stop or delete security-related processes and services, such as Sysmon, SentinelOne agents, Windows Defender, and logging agents like Filebeat. This is often an indicator of an adversary attempting to impair security defenses to hide malicious activities.
SentinelOne
