Fox Tempest - Revoked Certificate Execution (T1553.002)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•4

Detects the execution of binaries where the digital certificate has been explicitly revoked or timestamped after revocation.