SCCM Defender - On-Demand Scan for Specific Folder

[CHiLL]

Is is possible to perform an on-demand scan on a collection that only scans a specific folder?

 

We've been noticing some suspicious activity from C:\User\\ntuser.pol on the local (non-roaming) profile across multiple machines and multiple users. I have a feeling that this may be a false positive being reported by SCCM, but I'd like to be sure and run a scan for that specific location on a collection. We have real-time protection enabled and have ran both a quick scan and full scan on a collection. The Quick Scan doesn't appear to detect it, whereas a full scan and real-time does.

 

The detection is being reported as: Trojan:Win32/Bearfoos.A!ml. It was only added in December 2018's detection lists and ntuser.pol relates to the user's GPO settings from what I understand. These are what makes me wonder whether it is a false positive.