Code signed AI lure launching LOLBin
This rule spots signed fake AI software that launches trusted Windows utilities in unusual ways to hide malicious activity. Attackers abuse built-in tools so security software trusts the chain. Examine the parent installer and child commands. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Microsoft Sentinel (KQL)
