Security software termination is the deliberate stopping or disabling of protective tools, such as antivirus, endpoint detection and response (EDR), or monitoring agents. Attackers may do this to reduce the chance their later actions-such as credential theft, lateral movement, or ransomware encryption-will be detected or blocked.
In real attacks, malware may attempt to stop security processes or misuse privileged components, including vulnerable or legitimate drivers, to interfere with protection. Defenders can monitor for unexpected service or process shutdowns, unusual driver loads, and tampering alerts. Restricting driver installation, enabling tamper protection, and investigating abrupt loss of endpoint visibility can help catch this behavior before subsequent attack steps.