protections-artifacts/behavior/rules/windows/defense_evasion_unsigned_dll_from_suspicious_directory.toml at d59600196a2d19f5ac8e25b603e811946eebe1d1 · elastic/protections-artifacts · GitHub
https://github.com/elastic/protections-artifacts/blob/d59600196a2d19f5ac8e25b603e811946eebe1d1/behavior/rules/windows/defense_evasion_unsigned_dll_from_suspicious_directory.toml#L28