Detects loading of mpclient.dll, the Windows Defender client API library, by a process that is not part of the Windows Defender platform. mpclient.dll exposes APIs (IOAV, MpScan) used to drive Defender scans. In the ShieldBreak exploit, an attacker binary loads mpclient.dll directly and invokes its scan APIs against attacker-controlled content to trigger a Defender scan via an object-manager race, targeting Defender's placeholder-hydration behavior. If confirmed malicious, this activity indicates an attempt to weaponize Windows Defender's scanning pipeline for local privilege escalation by abusing Defender’s own components. The rule targets Sysmon EventID 7 (Image loaded) events where mpclient.dll is loaded by non-Defender processes, excluding Defender utilities and common legitimate paths, and correlates process and path information to surface potentially malicious loading. It maps to known privilege-escalation techniques and provides context for incident response and hunting, with highlighted false-positive considerations for legitimate security tooling that may legitimately load Defender API surfaces.