Detecting BOF impersonation via DISM. I’m left scratching my head on how you could go about detecting something like this without generating a ton of false positives. Would it just be monitoring for identity related alerts + DISM health checks?…