Detects when an attacker tries to hide from Sysmon by disabling or stopping it
Read the full analysis on IntelFusions