mpcmdrun.exe

MpCmdRun.exe (Microsoft Malware Protection Command Line Utility) controls Microsoft Defender Antivirus. It can start scans, update or roll back signatures, collect diagnostics, and restore quarantined items. Because Defender updates itself into versioned platform folders, the genuine binary lives under C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\MpCmdRun.exe (and a copy under Program Files\Windows Defender), not in System32.

Legitimately, MpCmdRun is run by administrators and by Defender's own tooling. The action it performs is what gives an instance meaning, and a couple of those actions are useful to attackers.

MpCmdRun.exe is a download proxy (T1105). Its -DownloadFile option fetches a file from a URL to a local path, so an attacker uses Defender's own signed tool to pull tooling onto the host under a name that security products are unlikely to flag. Watch for a MpCmdRun command line containing -DownloadFile and a URL, especially from an unusual parent.

It is also used to weaken Defender (T1685). MpCmdRun and the related configuration commands can remove signatures, disable scanning features, or restore quarantined files, blinding the very product it belongs to. Because the tool is legitimate, the action and the parent are what separate Defender administration from an attacker downloading payloads or switching protection off.