Microsoft Defender Writing Executables to System Folders

Luís Marques@remotecodeexecution

•updated today•0•0•0

Detects MsMpEng.exe writing executables or libraries into System32 or SysWOW64 directories, which can be indicative of junction-redirected remediation abuse.