Detect EDRKiller Tool Execution
The rule detects potential execution or presence of EDRKiller or similar tools by matching known malicious hashes from an external source against telemetry from Defender for Endpoint to help security analysts identify compromised endpoints, investigate delivery methods, and take remediation actions.
Microsoft Sentinel (KQL)
