AntiVirus Scan Cancelled Devices
This rule detects instances where an antivirus scan has been cancelled on a device. It specifically looks for 'AntivirusScanCancelled' actions in device events and extracts the 'ScanTypeIndex' from additional fields to provide context on the type of scan that was cancelled. This could indicate an attempt to evade detection by disabling security software.
Microsoft Sentinel (KQL)
