Windows MsMpEng Writing to System32 — Detection Rule
Detects MsMpEng.exe creating a file in C:\\Windows\\System32\\. This should never happen under normal operation Windows Defender does not install kernel drivers at runtime. In the BlueHammer exploit, the TOCTOU race causes MsMpEng (SYSTEM) to write the attacker's driver payload directly into the drivers directory.