eMudhra CA Key Compromise: Files Signed by Weak-Key Intermediate CAs
Hunts DeviceFileCertificateInfo for files signed by certificates issued by the eight eMudhra (and eight Sectigo) intermediate CAs with compromised weak keys. It matches on issuer hash, issuer name and CA serial, with an optional broader eMudhra/emSign match.
Microsoft Sentinel (KQL)
