Signed SentinelOne Binary Hash Associated with KREMLIN Loader Activity
Detects the presence or execution of a specific file hash associated with a known malicious campaign (KREMLIN/REF9334) that leverages a signed SentinelOne binary. This indicates potential abuse of trusted code-signing to bypass security controls.
Microsoft Sentinel (KQL)
