Windows Defender Restored Quarantined File
This rule detects when a file is restored from quarantine by Microsoft Defender Antivirus. This action is logged with Event ID 1009 in the Microsoft-Windows-Windows Defender/Operational event log. While legitimate administrators might restore files, this event can also indicate an adversary attempting to reintroduce malicious files that were previously quarantined, potentially as part of a defense evasion strategy.
Sigma
