Get in touch
← Sentinel Explorer
↳ GitHub sourceAnalytics ruleHigh

Samsung Knox - Mobile Device Boot Compromise Events

View on GitHub ↗Original file ↗

Description

When a Knox device boot binary is at risk of compromise.
Rule type
NRT
Version
1.0.2
Declared status
Available

Declared MITRE coverage

PersistenceT1645

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

SamsungDCDefinition

Data types

Samsung_Knox_System_CL

KQL query

Original query, unchanged.

Samsung_Knox_System_CL 
| where Name == "BOOT_COMPROMISED_SOFTWARE_BINARY"
and MitreTtp has "T1645"

Related content

Links established from declared identifiers and solution manifests.

Solutions1
Connectors1

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
fae7e371-aee8-4d3f-8311-2255a45a30b3
Additional source files 2Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxMobileDeviceBootCompromise.yamlsource ↗Solutions/Samsung Knox Asset Intelligence/Data/Solution_Samsung.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.