Ben Cole Finding cross-signed driver activity with Advanced Hunting in Defender For Endpoint From the April 2026 cumulative update, Windows enforces a new kernel driver policy that removes trust for drivers signed under the legacy cross-signed root program. Each device starts in evaluation mo... 26H2 Advanced Hunting Defender for Endpoint Driver signing KQL 7 Oct 2026