protections-artifacts/behavior/rules/windows/lateral_movement_potential_remote_execution_via_imsiserver.toml at 7c3ccfaa21b88ae633c47210f0cd60ec09bffab5 · elastic/protections-artifacts · GitHub
https://github.com/elastic/protections-artifacts/blob/7c3ccfaa21b88ae633c47210f0cd60ec09bffab5/behavior/rules/windows/lateral_movement_potential_remote_execution_via_imsiserver.toml#L8