A malware profile is configured with all the default settings for a specific endpoint group. For the same group, a restrictions profile has also been configured with the defaults, except with the restriction as shown in the image below. A user opens a command prompt and runs a mimikatz executable from C:\temp.

What is the first alert produced on the XDR Console for that endpoint?