Windows Defender Folder Hijack via Symbolic Link

Tim Peck@timpeck

•updated Sep 9, 2025•4•0•111

Detects the creation of a symbolic link in the Windows Defender Platform directory. This is a technique used to hijack the execution flow of Windows Defender, forcing it to run from an attacker-controlled location upon service restart or update.