braa raad
@brayee0 followers17 downloads1 copy0 likes80 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
1
1
1
This rule detects the creation of new files within the Microsoft Windows Defender program data folder. It specifically looks for file creation events where the initiating process is not a known, whitelisted Defender process. This behavior could indicate an attempt to tamper with or exploit Windows Defender, potentially to impair its defensive capabilities or to hide malicious activity.
