RoguePlanet - MpClient.dll Loaded by Non-Defender Process
Detects instances where 'MpClient.dll', a legitimate Microsoft Defender component, is loaded by a process that is not a known, trusted Microsoft Defender executable. This behavior can indicate an attempt to abuse Defender's scanning or cleaning APIs for malicious purposes, as seen in 'RoguePlanet' style attacks.
Microsoft Sentinel (KQL)
