SilentCanvas - Suppressed CAS Evidence Checks

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•1

Detects an attacker disabling Code Access Security (CAS) publisher validation by modifying a .NET .config file, specifically looking for modifications to files ending with '.config' in conjunction with a process command line containing 'generatePublisherEvidence'.