What attackers do. Attackers turn off, uninstall or reconfigure security tools such as antivirus, endpoint detection agents and logging services so their later actions go unnoticed. This sub-technique serves the Defence Evasion tactic and is a common step before ransomware.
How to defend. Enable tamper protection on security products, restrict who can change their configuration, and manage them centrally. Alert when an agent stops reporting, and treat that as a possible incident rather than an IT ticket. Block known vulnerable drivers that attackers use to kill security processes.
Signs to look for. Watch for security services being stopped or uninstalled, exclusions being added, policy changes outside change windows, and endpoints that go silent. The main gap is a silent sensor: if nobody alerts on missing telemetry, disabling the tool looks the same as a healthy quiet host.