#Dism

I’m left scratching my head on how you could go about detecting something like this without generating a ton of false positives. Would it just be monitoring for identity related alerts + DISM health checks? https://github.com/meowmycks/trustme