udm defender reparse udm context

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•3•0•2

Targets symbolic link, junction, or reparse-point operations against Defender quarantine, platform, or scan paths. The UDM rule retains principal and target context for correlation.