Certificate used for digitally signing malware.

Hunt Hypothesis

This rule detects adversaries leveraging valid digital certificates to sign malicious executables, a technique designed to bypass signature-based defenses and evade initial detection by security tools. Proactively hunting for this behavior in Azure Sentinel is critical because it allows analysts to identify trusted identities that have been compromised or abused to deliver malware, ensuring early intervention before the threat spreads across the environment.

YARA Rule

rule cert_blocklist_0c15 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "William Richard John" and
            pe.signatures[i].serial == "0c:15" and
            1387324799 <= pe.signatures[i].not_after
        )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Certificate used for digitally signing malware” detection rule, including targeted filters and exclusions:

• Antivirus Engine Updates

  • Scenario: Major security vendors (e.g., CrowdStrike Falcon, Microsoft Defender Antivirus, or Symantec Endpoint Protection) frequently update their signature databases. These updates are often signed by the vendor’s root certificate, which may have been previously flagged for signing a specific malware family in a different context.
  • Filter/Exclusion: Create an exclusion rule based on the executable path and process name (e.g., C:\Program Files\CrowdStrike\csagent.exe or MsMpEng.exe) combined with a whitelist of known vendor certificate thumbprints.

• Scheduled Patch Deployment Jobs

  • Scenario: Enterprise patch management tools like Microsoft SCCM (Configuration Manager) or Ivanti Neurons execute scheduled jobs to deploy OS and application updates. These deployment agents often utilize the same signing certificates used for the underlying update packages, which might include components previously identified as suspicious in other environments.
  • Filter/Exclusion: Exclude processes running under specific service accounts (e.g., NT SERVICE\CCMExec or IvantiAgent) during defined maintenance windows (e.g., 02:00–04:00 UTC) where patching occurs.

• CI/CD Pipeline Artifact Signing

  • Scenario: DevOps teams using Azure DevOps, Jenkins, or GitHub Actions often sign build artifacts and deployment scripts with a centralized corporate code-signing certificate. If this certificate was previously associated with a malware signature in the threat intelligence feed, legitimate CI/CD builds (e.g., msbuild.exe or dotnet.exe) may trigger alerts during release cycles.
  • Filter/Exclusion: Filter out events where the parent