[IA] - Detecting Potential Fake Installers
This is something I have seen many times during my years working in cybersecurity: users download software with a filename they recognize and trust, but the file behind that name can be something completely different. Monitoring the filename is not enough. Monitoring the hash is better, but legitimate software changes constantly: new version, new SHA256, another hash to validate and maintain. So I started thinking about how AI agents could help us here — not by deciding what is malicious, but by doing the repetitive work for us. For this research, I built an AI-maintained baseline of legitimate software and used it from KQL to hunt two different scenarios: 🎯 Known filename + Unknown hash + Untrusted download source
Microsoft Sentinel (KQL)
