EDR/AV Process Termination via taskkill.exe or sc.exe

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•6

Detects attempts to stop or delete security-related services (such as Microsoft Defender, Cylance, CrowdStrike, SentinelOne, Malwarebytes, or Bitdefender) using native Windows utilities like taskkill.exe or sc.exe.