This rule detects Windows Defender malware detections or remediation events where the scanned path resolves through the NT object manager namespace, specifically entries under \globalroot\, which is abnormal for Defender activity. It relies on Windows Defender Operational logs (EventCodes 1116 for detections and 1117 for remediation) to identify such activity. In the ShieldBreak exploitation scenario, adversaries coerce Defender into hydrating a cloud file placeholder and copying attacker content through a chain of symbolic links that culminates in a write to C:\Windows\System32. The analytic flags this pattern as suspicious because legitimate Defender scans do not report paths resolved via the NT object manager namespace. The detection logic is expressed as a Splunk search filtering EventCode IN (1116, 1117) and Path matching *\globalroot\*, aggregating results by host, user, Path, Threat_Name, and Severity, and surfacing a finding such as: "Windows Defender reported a detection on a kernel object path $Path$ on $dest$". If confirmed malicious, this indicates an attempt to weaponize Defender’s scanning pipeline for local privilege escalation. Known false positives are not observed; legitimate Defender activity does not typically involve NT object namespace paths. The rule supports defensive investigations by highlighting unusual Defender-driven file operations and potential privilege escalation vectors.