All Detections

Fox Tempest - Bypassing Mark-of-the-Web via Signing (T1553.002)

avatar
Ibrahim Saud@tektrix
updated Jun 21, 2026005

Detects files retaining the MOTW (Zone.Identifier) executing successfully because their Fox Tempest signature bypasses SmartScreen warnings.

Microsoft Sentinel (KQL)