Disabling AV With Process Suspension

This research post demonstrates a technique to suspend Windows Defender and other protected processes using beacon object files to perform LSASS minidumps (enabling Mimikatz use), highlighting an oversight where suspend/resume access is permitted while terminate is blocked; the author warns of system instability and logging blind spots, encourages vendors to close the gap, and suggests Sysmon-based detections as partial mitigation.