Signed vs. Unsigned Drivers/Processes Cyber Observables

[ikiril01]

Jason pointed out that we currently can't characterize signed vs. unsigned processes and drivers in Cyber Observables. For processes, this would mean adding a new property to the Process Cyber Observable Object. For drivers, we'd have to add a new Cyber Observable Object.

[gtback]

Is the process itself signed, or the file that is used to launch the process? Almost seems like this would be better for extension(s) of the File object.

[JasonKeirstead]

Use case example: Match when any unsigned executable has been loaded into lass.exe