We (F-PROT) had something similar, minus the telemetry.
The reason for them was to speed up the scanning process. They were short and fast and easy to check. Signature not present - just don't bother scanning any further. Signature present - that by itself doesn't warrant a report but triggers our other, more precise but slower malware identification algorithms.
I don't know what Microsoft is using these for but this might be the idea behind them too.
VessOnSecurity
npub1gx…7tun6
2025-11-14 05:59:16 UTC
in reply to nevent1q…ygf7
Author Public Key
npub1gxa39sc7wtpmatdx9rkplkplaquyug2vfhk23dl54slsnmuzf45sh7tun6Seen on
wss://relay.momostr.pinkPublished at
2025-11-14 05:59:16 UTCEvent JSON
{
"id": "03f5f19fc0280413db5a75df5ba93f549cc876a3ef1de8170a651a5c32f178ef",
"pubkey": "41bb12c31e72c3beada628ec1fd83fe8384e214c4deca8b7f4ac3f09ef824d69",
"created_at": 1763099956,
"kind": 1,
"tags": [
[
"e",
"0e98c534f5aa840976e4599c49557c6644d1cccf6337a4a4e5349b04940d9ad0",
"",
"root",
"fe31a74ce7a735689686a4a8bdb765a8f4db945d91b67412c75058a82a51cffd"
],
[
"p",
"fe31a74ce7a735689686a4a8bdb765a8f4db945d91b67412c75058a82a51cffd"
],
[
"proxy",
"https://infosec.exchange/@bontchev/115546518777785899",
"web"
],
[
"proxy",
"https://infosec.exchange/users/bontchev/statuses/115546518777785899",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/bontchev/statuses/115546518777785899",
"pink.momostr"
],
[
"-"
]
],
"content": "We (F-PROT) had something similar, minus the telemetry.\n\nThe reason for them was to speed up the scanning process. They were short and fast and easy to check. Signature not present - just don't bother scanning any further. Signature present - that by itself doesn't warrant a report but triggers our other, more precise but slower malware identification algorithms.\n\nI don't know what Microsoft is using these for but this might be the idea behind them too.",
"sig": "1033ce51f7ec7b8ee3e869b32794a9fc31336be27d026b54cf825c1de1184a60464c33d44068718f1ab415e4398945f57e955d3ae189bb138b0d39bbd8a209de"
}