Windows Suspicious File in EFI Volume — Detection Rule
Detects data files in the EFI volume. This is sometimes indicative of an actor attempting to bypass secure boot through vulnerabilities such as CVE-2024-7344. These use vulnerable boot loaders to run malicious system firmware code.