I believe this is a false positive but would like to know more about how the "User Login" is affected in this instance.

Event name: ATC.Malicious

Att&ck Tactics: N/A

Event description: Advanced Threat Control has labeled explorer.exe as a potential threat to your system.

Event name: SuspiciousSignedProcessExecution

Att&ck Tactics: Defense Evasion

Event description: A signed suspicious process has been executed

ATT&CK Techniques: Subvert Trust Controls – T1553.002 Code Signing

Event name: user_login

Event description: User Login

Event name: Process Create

Att&ck Tactics: N/A

Event description: A process has been created.

Event name: Process Create

Att&ck Tactics: N/A

Event description: A process has been created.

Every time I close and then open Explorer.exe, I get a notice from Bitdefender saying that it has detected a threat.

I then click on "View attack timeline" and am shown that there is an exploit of something that has been successfully blocked.

The timeline is as follows:

Operating system executed a process winlogon.exe

winlogon.exe executed explorer.exe

explorer.exe signed by Microsoft Corporation executed 3dbrowser.exe

The file C:\Users\...\AppData\Local\Temp\magick-MtWHarig is infected with Exploit.CVE-2016-3718.gen. The threat has been successfully blocked, your device is safe.

I went to that folder and deleted all file names with the name starting with magick and then emptied my Recycle Bin.

3dbrowser.exe is software that allows me to easily view my 3D files.

Why does this happen every time I open explorer.exe and how can I stop it for good?

Any help will be greatly appreciated,

edsager

They should add an option to make it so we can clear them like the notifications.

Is there any way to do so? They should make it so we can clear them like the notifications.