File Download Via Windows Defender MpCmdRun.EXE
Detects the use of Windows Defender's MpCmdRun.exe utility to download files from a specified URL. This technique can be abused by adversaries for ingress tool transfer or to bypass security controls by using a legitimate, signed Microsoft binary.
Sigma
