legitimate administrator activity restoring a file

source: <a href=https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_restored_quarantine_file.yml>sigma
technicques: t1562 t1562.001

Techniques

Detects the restoration of files from the defender quarantine

condition: selection
selection:
  EventID: 1009