Certificate used for digitally signing malware.

Hunt Hypothesis

This detection identifies adversaries leveraging valid digital certificates to sign malicious executables, a technique often employed to evade signature-based security controls and establish trust with endpoints. Proactively hunting for this behavior in Azure Sentinel is critical because attackers increasingly abuse legitimate certificate authorities to bypass initial threat scans, necessitating deeper analysis of signing patterns to uncover stealthy malware campaigns that traditional rules might overlook.

YARA Rule

rule cert_blocklist_028e1deccf93d38ecf396118dfe908b4 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Fortuna Games Co., Ltd." and
            pe.signatures[i].serial == "02:8e:1d:ec:cf:93:d3:8e:cf:39:61:18:df:e9:08:b4" and
            1392163199 <= pe.signatures[i].not_after
        )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Certificate used for digitally signing malware,” along with targeted filters and exclusions:

• Scenario: Automated Deployment of Security Agents via Configuration Management Tools

  • Context: Enterprise tools like Microsoft SCCM (Configuration Manager) or Ansible Tower frequently push security agent updates (e.g., CrowdStrike, SentinelOne) to thousands of endpoints. These agents are signed by the vendor’s certificate, which may have previously flagged a specific malware variant using the same root CA.
  • Filter/Exclusion: Exclude processes where the parent process is ccmsetup.exe (SCCM), Ansible-Runner, or Puppet Agent. Additionally, filter out events where the file hash matches known “Good” hashes stored in a central allow-list database for these specific vendor updates.

• Scenario: Scheduled PowerShell Script Execution by System Administrators

  • Context: Admins often run scheduled tasks (via Windows Task Scheduler) that execute complex .ps1 scripts to patch systems or clean logs. These scripts are frequently signed with a corporate internal code signing certificate. If this certificate was previously associated with a malware campaign, the rule triggers on every script execution.
  • Filter/Exclusion: Create an exclusion for process names matching powershell.exe where the command line contains specific administrative keywords (e.g., -ExecutionPolicy Bypass, -File C:\AdminScripts\). Furthermore, whitelist the specific Thumbprint of the internal corporate code-signing certificate used by the IT Operations team.

• Scenario: Legitimate Cloud Backup and Archiving Solutions

  • Context: Enterprise backup solutions like Veeam Backup & Replication, Rubrik, or Acronis Cyber Protect utilize background services to encrypt and sign data chunks before transmission. These services often use a shared signing certificate that might