Windows Suspicious Defender Update Activity in INetCache — Detection Rule
Detects a non-Defender process writing mpam-fe*.exe to the Windows Internet Cache (INetCache). BlueHammer downloads the WD signature update package directly using WinINet as a low-privileged user. The [1].exe naming suffix is produced by Windows HTTP caching and is a reliable artifact of this download method.