File Download via Windows Defender MpCmdRun.exe
Detects the use of the Windows Defender command-line utility, MpCmdRun.exe, to download files. This utility is typically used for managing Windows Defender, but adversaries can abuse its 'DownloadFile' function to retrieve arbitrary files from a specified URL, often for staging malicious payloads or tools.
YARA-L
