CrySome AVKiller module disabling AV/EDR via taskkill, service stop, or scheduled task tampering
This rule monitors for suspicious activity aimed at disabling or tampering with security software, including antivirus processes and services. It identifies execution of tools named 'AVKiller.exe', the usage of commands like 'taskkill', 'net stop', or 'sc stop' against known security-related processes, and the modification of Windows Defender scheduled tasks to disable security scans.
Microsoft Sentinel (KQL)
