[WINDOWS-SYSMON] Windows Defender has detected malware (High)

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SYSMON] Windows Defender has detected malware (High)"; program:*Windows*Defender*; event_id:1116; content:"Severity
| 3a
| High"; content:!"Category
| 3a
| Potentially Unwanted Software"; reference:url,app.any.run/tasks/95f2e73d-2767-4f87-8e97-825d10b4665c/; classtype:malware; sid:5017936; rev:1; metadata:deployment Endpoint,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2026_08_14, updated_at 2026_08_14, mitre_tactic_id TA0005, mitre_technique_id T1562.001;)