protections-artifacts/behavior/rules/privilege_escalation_unusual_desktop_window_manager_child_process.toml at ecde1dfa1aaeb6ace99e758c2ba7d2e499f93515 · elastic/protections-artifacts · GitHub
https://github.com/elastic/protections-artifacts/blob/ecde1dfa1aaeb6ace99e758c2ba7d2e499f93515/behavior/rules/privilege_escalation_unusual_desktop_window_manager_child_process.toml#L15