G12/G13 killer tool execution preceding security-product process termination
This rule detects the execution of processes associated with G12/G13 EDR-killer tools. These tools are specifically designed to automate the termination of security software, antivirus solutions, and remote management processes, which is a common tactic used by adversaries to evade detection and maintain persistence.
Microsoft Sentinel (KQL)
