Microsoft Defender Blocked from Loading Unsigned DLL — Detection Rule

Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL

Read the full analysis on IntelFusions