Defender Creating Unusual File
The rule detects an object access event (Event ID 4663) initiated by Windows Defender, where the target file is located outside the legitimate Microsoft Defender directories (C:\Windows\System32\ or C:\ProgramData\Microsoft\), indicating potential usage of a tool like "EDRStartupHinder".
Splunk (SPL)
