RoguePlanet: Defender Quarantine File Overwritten by Unprivileged Process in %TEMP%
Detects a specific exploit pattern where a malicious process triggers Microsoft Defender (MsMpEng.exe) to write a quarantine artifact to a user-controlled directory (such as a TEMP subdirectory), which is then immediately overwritten by an unprivileged process. This behavior indicates an attempt to exploit the Defender quarantine pipeline for unauthorized file manipulation or potential privilege escalation.
Microsoft Sentinel (KQL)
