Sysinternals PsSuspend Execution — Detection Rule

Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes

Read the full analysis on IntelFusions