it isnt actually defender being used, the interprocess communication is apparently wide open for an imposter process.

https://github.com/Nightmare-Eclipse/BlueHammer

[also: https://github.com/atroubledsnake/SNEK_Blue-War-Hammer ]

defender needs some better handling of the unexpected.