EFI System Partition Writes by Non-Servicing Processes (Bootkit/MOK Enrollment)
Detects file creation, modification, or renaming in EFI boot paths (such as \EFI\Boot\ or \EFI\Microsoft\Boot\) by processes other than standard Windows OS servicing components like TrustedInstaller.exe or setup.exe. This activity is indicative of bootkit installation or persistence establishment via the EFI system partition.
Microsoft Sentinel (KQL)
