Suspicious File Creation in Windows Defender Folder
This rule detects the creation of new files within the Microsoft Windows Defender program data folder. It specifically looks for file creation events where the initiating process is not a known, whitelisted Defender process. This behavior could indicate an attempt to tamper with or exploit Windows Defender, potentially to impair its defensive capabilities or to hide malicious activity.
Sigma
