Certificate used for digitally signing malware.

Hunt Hypothesis

This detection identifies adversaries leveraging valid digital certificates to sign malicious executables, a tactic designed to evade signature-based security controls and establish trust with endpoints. Proactive hunting in Azure Sentinel is essential because attackers increasingly abuse legitimate certificate authorities to bypass initial defenses, requiring analysts to validate the reputation of signing entities beyond simple binary signatures.

YARA Rule

rule cert_blocklist_0a77cf3ba49b64e6cbe5fb4a6a6aacc6 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "I.ST.SAN. Srl" and
            pe.signatures[i].serial == "0a:77:cf:3b:a4:9b:64:e6:cb:e5:fb:4a:6a:6a:ac:c6" and
            1371081599 <= pe.signatures[i].not_after
        )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Certificate used for digitally signing malware” detection rule, along with suggested filters and exclusions:

• Scenario: Automated Patch Deployment via Microsoft Update

  • Context: The Windows Update service (usoc.dll) or WSUS server downloads and installs security patches. These updates are often signed by a certificate that has historically been associated with malware variants in the industry (e.g., a shared root CA used by both vendors). When the patch installer executes, it triggers the rule because the signing certificate matches the “malware-associated” profile.
  • Suggested Filter: Exclude processes where the Parent Process Name is usoc.dll, wuauclt.exe, or wuauserv.exe. Additionally, filter out events where the file path contains \Windows\SoftwareDistribution\ and the action type is “Installation” or “Update”.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise endpoint protection suites like CrowdStrike Falcon, SentinelOne, or Symantec Endpoint Protection run scheduled jobs (e.g., every 4 hours) to download the latest threat intelligence definitions. These definition packages are digitally signed by a certificate that may be flagged as “used for signing malware” due to its widespread use across multiple security vendors. The update agent executing these downloads triggers the alert.
  • Suggested Filter: Create an exclusion based on Process Name matching known AV agents (e.g., FalconSensor.exe, SentinelOneAgent.exe, SymantecClient.exe) and File Path containing \Program Files\ or \Windows\System32. Ensure the filter applies only when the process is running under a system account context (SYSTEM or NT AUTHORITY).

• Scenario: Deployment of Enterprise Applications via SCCM/Intune