Suspicious Access to ThreatLocker Policies File
This rule detects attempts by processes other than the legitimate ThreatLocker service to open the 'policies.txt' file located in the ThreatLocker installation directory. This could indicate an attempt to tamper with or exfiltrate ThreatLocker policies.
Cortex XDR
