Code Integrity - Disallowed File Blocked for Protected Processes
This rule detects events where Windows Code Integrity blocks a file because it is disallowed for protected processes. This indicates an attempt to load or execute an unauthorized file within a protected process environment, which could be a sign of privilege escalation or an attempt to bypass security controls.
Sigma
