Masquerading: Invalid Code Signature - Network Connections

// set timeframe, default is 1day to allow for large environments, in smaller sets (<5K endpoints) you could extend this
let TimeFrame = ago(1d);
// get processes calling outbound to the internet
let networkConnections = 
    DeviceNetworkEvents
    // filter all RCF-1918 address space
| where not(ipv4_is_match(RemoteIP, '192.168.0.0/16') or ipv4_is_match(RemoteIP, '172.16.0.0/12') or ipv4_is_match(RemoteIP, '10.0.0.0/8')) and Timestamp > TimeFrame
    // skipping system processes
    and InitiatingProcessId !in (0, 4)
    // only established connections
    and ActionType  == "ConnectionSuccess"
    // rename hash field to allow for later joining
| project-rename SHA1 = InitiatingProcessSHA1
| project Timestamp,DeviceName,DeviceId,InitiatingProcessFileName,InitiatingProcessFolderPath, InitiatingProcessCommandLine ,InitiatingProcessId, RemoteIP, RemoteUrl, SHA1;
// get binaries that are not signed or binaries of which the certificateState is untrusted
let certificateState = 
    DeviceFileCertificateInfo
| where Timestamp >= TimeFrame
| where IsSigned == 0 or IsTrusted == 0
| project DeviceId, SHA1;
// join the connections to the internet and let the ones remain with questionable certificate certificateState
let unsignedConnections = 
	networkConnections
| join kind=leftsemi (certificateState) on DeviceId,SHA1;
// query results
unsignedConnections