Security-named program requests logon task to relaunch itself

A program running as Windows Security.exe launched the Windows task utility with a revealing instruction: create a task called “Windows Defender Security,” triggered at logon, that would run the same roaming-profile path as its parent. The security branding raises a practical question: was this a protective component, or a program arranging its own return under a reassuring name? Sandbox events reviewed by CTX Threat Intelligence support the latter interpretation.