Suspicious Kaspersky Endpoint Security Stopped Through CommandLine - Linux (via process_creation)

This rule detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl. This behavior may indicate a manual interruption of the antivirus service by an administrator, or it could be a sign of potential tampering or evasion attempts by hostile actors.