Suspicious Execution of Windows Defender Critical Binaries

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects suspicious execution of Windows Defender Binaries either executed from an unusual location or binary trying to masquerade as a legitimate Windows Defender binary. This behavior can be indicative of an attacker trying to hide their malicious binary by masquerading as a legitimate Windows Defender binary or some exploit trying to bypass Windows Defender.

2026-07-15 00:00:00

None

61ecba13-053a-4bd0-8436-c58d7f7dc174

attack.stealth attack.t1036.005 attack.t1036

Nextron Sigma feed only (private)