T1027 on sentinelchangelog.nethttp://sentinelchangelog.net/tags/t1027/Recent content in T1027 on sentinelchangelog.netHugo -- 0.157.0enFri, 03 Jul 2026 07:48:54 +0000New Hunting Query: BadUSB HID Injection via certutil LOLBIN Detected Through explorer.exe Parent Signalhttp://sentinelchangelog.net/posts/2026-07-03-pr-14600/Fri, 03 Jul 2026 07:48:54 +0000http://sentinelchangelog.net/posts/2026-07-03-pr-14600/A new hunting query surfaces BadUSB payloads that abuse certutil.exe or cmd.exe via the WIN+R Run dialog by keying on explorer.exe as the initiating process – a signal absent from existing generic certutil LOLBin detections.