Skip to content
Threat Feed
Subscribe

Product

Sysinternals PsSuspend

2 briefs RSS
high advisory

Sysinternals PsSuspend Suspicious Execution to Impair Defenses

Adversaries are leveraging the legitimate Sysinternals PsSuspend utility to suspend critical security processes, such as Microsoft Defender Antivirus (`msmpeng.exe`), as a defense impairment technique to bypass endpoint detection and response (EDR) solutions.

Sysinternals PsSuspend defense-evasion utility sysinternals windows
1r
medium advisory

Abuse of Microsoft Sysinternals PsSuspend Utility

Unidentified threat actors may leverage the legitimate Microsoft Sysinternals PsSuspend utility to suspend critical processes on Windows systems, enabling evasion of security controls or disruption of operations.

Sysinternals PsSuspend sysinternals living-off-the-land process-manipulation windows tool-abuse
1r 4t