The digital certificate has leaked.

Hunt Hypothesis

This detection rule identifies potential exposure of sensitive digital certificates that could enable adversaries to perform man-in-the-middle attacks or impersonate trusted services within the Azure environment. Proactively hunting for this behavior is critical because compromised certificates often serve as a silent entry point for lateral movement and data exfiltration, allowing attackers to operate undetected until significant damage occurs.

YARA Rule

rule cert_blocklist_05e2e6a4cd09ea54d665b075fe22A256 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "The digital certificate has leaked."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "*.google.com" and
            pe.signatures[i].serial == "05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56" and
            1308182400 <= pe.signatures[i].not_after
        )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “The digital certificate has leaked” detection rule in an enterprise environment, including suggested filters and exclusions:

• Scheduled Certificate Renewal via PowerShell

  • Scenario: An automated nightly job using PowerShell (e.g., running Renew-Item or Get-Certificate) on a Domain Controller to refresh SSL/TLS certificates for internal web services. The script extracts the certificate thumbprint and logs it, which the rule interprets as a potential leak of sensitive key material.
  • Filter/Exclusion: Create an exclusion based on the process name powershell.exe combined with the command line argument containing -Command "Renew-Certificate". Additionally, exclude events originating from specific Service Accounts (e.g., svc-cert-renew) known to perform this task.

• Cloudflare or Azure Key Vault Backup Operations

  • Scenario: A scheduled backup job in Azure Key Vault or AWS Secrets Manager triggers an export of certificate metadata for compliance auditing. The system generates a log entry indicating the certificate object was accessed and “leaked” to the audit trail, which mimics a security breach signature.
  • Filter/Exclusion: Filter out events where the source IP belongs to the cloud provider’s internal management subnet (e.g., Azure 10.x.x.x or AWS VPC CIDR ranges) and the action type is specifically “AuditLogExport” or “BackupSnapshot”.

• DevOps Pipeline Artifact Generation

  • Scenario: During a CI/CD run in Jenkins or GitLab, the pipeline stage responsible for container image signing extracts the digital certificate to embed it into the Docker image manifest. This extraction process triggers the rule as if the certificate was exposed to an external network segment.
  • Filter/Exclusion: Exclude