Denylist

Intrusion detection can inspect file, network, and kernel reads and writes to verify or block them with an allowlist or a denylist (as seccomp-bpf configuration does).

Remediation can entail contacting the user and instructing them to cease; it could be autoremediation by reconfiguring a managed endpoint, or it could be to denylist the device MAC address(es).