Tapmper protection is great but bubbling up alerts about attempts to kill the process would be a good IOC to alert on.