Advance Threat Analysis

Hi this is my rule for defender service stop with token impersonation [defenderstop_2.txt](https://github.com/SigmaHQ/sigma/files/8010298/defenderstop_2.txt) `title: defender stop with trustedinstaller token impersonation id: status: experimental description: detect windows defender service stop with...

lateral movement with windows sc manager

here is the spoolfool evtx [spoolfool.zip](https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/files/8102712/spoolfool.zip)