Finding Weak Service Executable Paths with Defender TVM and PowerShell

Microsoft Defender can flag services that run outside common protected locations. This post shows how to use KQL to identify the affected service paths and PowerShell to validate whether the base folders are writable by broad user groups.