Detection of Malicious Code Signing Certificates
This rule identifies the use of specific malicious code signing certificates by matching their SHA1 thumbprints against a predefined list. These certificates are known to be associated with various threat actors or malicious software, indicating potential supply chain compromise or the use of signed malware.
Microsoft Sentinel (KQL)
