Non-browser clients reaching eMudhra compromised-CA checker hosts
Detects non-browser clients or runtimes (such as curl, python, node, or Electron-based apps) successfully connecting to or referencing compromised eMudhra certificate status checker hosts, indicating systems that still trust compromised intermediate certificates.
Microsoft Sentinel (KQL)

