Fox Tempest - Signed Dropper Network Exfil (T1041)
This rule detects validly signed executables making HTTP POST connections, which could indicate data exfiltration or command and control (C2) communication by a signed dropper. It correlates network events with image load events to identify processes with valid signatures performing HTTP POST requests.
Microsoft Sentinel (KQL)
