Fox Tempest - Signed Driver Loading (Rootkit)
Detects the usage of Fox Tempest certificates to sign and load malicious .sys drivers into the Windows kernel space to blind EDR. The rule specifically looks for signed .sys files being loaded from temporary or downloads folders.
Microsoft Sentinel (KQL)
