Bulk Termination of Multiple Third-Party AV/EDR Processes
Detects when multiple security agent processes are terminated on a single host. Monitoring for the simultaneous or rapid termination of security products like Windows Defender, Cylance, SentinelOne, or Falcon suggests an attempt to disable endpoint protections before further malicious activity.
Cortex XDR
