Mass termination of AV/security and monitoring processes

Subhankar H@Andrewsec57

•updated Jul 8, 2026•1•0•2

Detects the manual or malicious termination of security-related processes, including antivirus software, endpoint protection agents, and diagnostic/monitoring tools (e.g., Task Manager, Process Explorer, Wireshark). Such behavior is often indicative of an adversary attempting to impair security defenses to facilitate further malicious activity.