Security Tool Tampering: EDR/AV Disablement (T1562.001)

Ibrahim Saud@tektrix

•updated 6 days ago•0•0•0

Detects attempts to disable, modify, or stop security software and endpoint protection services. The rule monitors for registry changes to Windows Defender settings, manual service management commands (sc, net) targeting security processes, and PowerShell execution using 'Set-MpPreference' to disable protection features.