Certificate used for digitally signing malware.

Hunt Hypothesis

This rule detects adversaries who leverage valid digital certificates to sign malicious executables, thereby evading signature-based defenses and establishing trust with endpoint security solutions. Proactively hunting for this behavior in Azure Sentinel is essential because attackers increasingly abuse legitimate certificate authorities to bypass initial detection mechanisms and facilitate lateral movement within the environment.

YARA Rule

rule cert_blocklist_094bf19d509d3074913995160b195b6c {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Porral Twinware S.L.L." and
            pe.signatures[i].serial == "09:4b:f1:9d:50:9d:30:74:91:39:95:16:0b:19:5b:6c" and
            1373241599 <= pe.signatures[i].not_after
        )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Certificate used for digitally signing malware” detection rule, including suggested filters and exclusions:

• Antivirus Engine Updates via Scheduled Tasks

  • Scenario: Enterprise Endpoint Protection suites (e.g., Microsoft Defender Antivirus, CrowdStrike Falcon) frequently download and install signature definition updates. These updates are often signed by the vendor’s root certificate, which may also be used to sign known malicious payloads in other contexts. The scheduled update job triggers a new process execution that looks like a potential malware signing event.
  • Filter/Exclusion: Exclude processes where the ImageName matches known AV executables (e.g., MsMpEng.exe, FalconSensorService.exe) running under the context of specific scheduled tasks (e.g., “Windows Defender Update”) or Service accounts (NT SERVICE\Wuauserv).

• Software Deployment via Configuration Management Tools

  • Scenario: IT administrators use tools like Microsoft System Center Configuration Manager (SCCM), Ivanti, or Ansible to push software patches and new applications. These deployment agents often utilize a corporate code-signing certificate that is shared across various legitimate installers and potentially some known malware signatures in the threat intelligence feed.
  • Filter/Exclusion: Create an exclusion for processes launched by ccmsetup.exe (SCCM), IvantiAgent.exe, or ansible-playbook where the parent process is a recognized management service, and the file hash matches a known “Good” baseline in the asset inventory.

• Automated CI/CD Pipeline Artifact Signing

  • Scenario: In DevOps environments, automated build pipelines (e.g., Jenkins, GitHub Actions) sign compiled binaries or container images before deployment to production. The signing certificate used for these legitimate artifacts might overlap with certificates flagged in the malware database due to previous compromise events or shared