Add "Microsoft Security Client" directory for MsMpEng.exe (Win<8)

rules/windows/process_creation/win_proc_wrong_parent.yml

@@ -9,7 +9,7 @@ references:
     - https://www.13cubed.com/downloads/windows_process_genealogy_v2.pdf
     - https://attack.mitre.org/techniques/T1036/
 date: 2019/02/23
-modified: 2020/09/06
+modified: 2020/03/15
 tags:
     - attack.defense_evasion
     - attack.t1036 # an old one
@@ -36,6 +36,7 @@ detection:
             - '*\SysWOW64\\*'
             - '*\SavService.exe'
             - '*\Windows Defender\\*\MsMpEng.exe'
+            - '*\Microsoft Security Client\\*\MsMpEng.exe'
     filter_null:
         ParentImage: null
     condition: selection and not filter and not filter_null