Mass Enumeration/Termination of Backup, AV, and DB Services (Beast/GodDamn Pre-Encryption)
Detects anomalous activity where a single process or actor attempts to stop or reconfigure a large number of system services, specifically targeting backup, database, security, and administrative services. This behavior is highly indicative of ransomware or destructive malware activity attempting to disable defenses and data recovery capabilities.
Cortex XDR
