Anomalous shell child process spawned by MsMpEng.exe with SYSTEM token (ShieldBreak)
Detects instances where the Windows Defender antimalware service (MsMpEng.exe) spawns common shell processes (cmd.exe, powershell.exe, pwsh.exe, or conhost.exe) while running under the SYSTEM account. This behavior is highly anomalous and indicative of potential exploitation involving privilege escalation via the Microsoft Defender process.
Microsoft Sentinel (KQL)
