LOLBin-dropped or LOLBin-launched non-Microsoft-signed/unsigned executables
Detects executables launched by common LOLBins (msiexec, powershell, cmd, wscript, cscript, regsvr32, rundll32) that are either signed by a non-Microsoft/non-trusted-third-party publisher, or entirely unsigned.
Microsoft Sentinel (KQL)
