ShieldBreak object manager namespace hijack of Defender scan target
Detects creation of restricted object manager namespace objects (WD_TARGET_/WD_SHADOW_/WD_SCAN) used to hijack Microsoft Defender's on-access scan target as part of the ShieldBreak exploit, excluding objects created by signed Microsoft/Defender processes.
Splunk (SPL)
