Chris Forsythe
@TheTick1 follower6 downloads8 copies1 like455 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
1
1
Platforms
1
Products / Services
1
1
1
1
1
MITRE Techniques
1
1
1
1
1
Detects attempts to suspend or terminate Endpoint Detection and Response (EDR) agent processes by targeting their Process IDs (PIDs). The rule identifies suspicious command-line arguments and tools (e.g., procdump, WerFault) used to interact with processes, specifically looking for these actions against a predefined list of common EDR agent executable names. It correlates process creation events with process ID resolution to identify the targeted EDR agent.
