Detection of Binaries Signed by 'OneStart Technologies LLC'
This rule identifies potentially suspicious signed binaries in the environment by looking for files signed by 'OneStart Technologies LLC' and excluding common, known good vendors. This helps detect the abuse of code signing certificates by threat actors to bypass security controls and can support threat hunting and malware analysis.
Microsoft Sentinel (KQL)
