Unusual Software Uninstall Activity
This rule detects an unusual number of software uninstall activities on a system within a one-hour window. It specifically looks for command lines containing 'uninstall' or 'remove' along with 'KB' (Knowledge Base update) or 'package', which could indicate an attempt to remove security updates or other software.
Microsoft Sentinel (KQL)
