Unsigned Image Loaded by Code Integrity
Detects when an unsigned image (DLL, EXE, etc.) is loaded into the system, as reported by Windows Code Integrity. This can indicate attempts to bypass security controls, execute malicious code, or privilege escalation.
Sigma
