Signed Binary Used as Proxy for Execution
Detects signed Windows binaries abused as execution proxies for defense evasion
Microsoft Sentinel (KQL)

Detects signed Windows binaries abused as execution proxies for defense evasion

Already have an account?