MsMpEng.exe Anomalous Child Process or globalroot\BaseNamedObjects Scan (ShieldBreak)
Detects Windows Defender process-level interaction consistent with the ShieldBreak exploit: MsMpEng.exe spawning an unexpected child process (excluding known-legitimate Defender helpers), or Defender's on-access scanner being triggered against unusual globalroot\BaseNamedObjects object-manager paths instead of normal filesystem paths.
Cortex XDR
