Detection rules › By eventMicrosoft-Windows-Windows-Defender event 10091 detection rule reference this event. View event page.Sigma (1)Win Defender Restored Quarantine File severity high T1562.001