Another new integration with MDATP is THOR Scanner THOR extends Microsoft Defender ATP’s real-time monitoring by intense local scans to allow a full on-demand compromise assessment. THOR is a forensic scanner that integrates into MDATP to scans the local filesystem, registry, logs and other elements for traces of hacking activity using 10,000 hand-written YARA rules and thousands of filename, C2, hash, mutex and named pipe IOCs to them. This live forensic scan reduces the work of your forensic analysts to a minimum and generates results as fast as possible for you to react in a timely manner. https://www.nextron-systems.com/2020/01/07/thor-integration-into-windows-defender-atp
Microsoft