Fox Tempest - Low Prevalence Signed Binary (T1553.002)
Detects the execution of newly seen binaries containing valid Digital Signatures from issuers identified in Fox Tempest's malware signing service. This rule specifically looks for process creation events where the binary has a valid digital signature and a global prevalence of less than 50, and then joins these events with network connection events from the same device, indicating execution and beaconing activity.
Microsoft Sentinel (KQL)
