Certificate used for digitally signing Careto malware.

Hunt Hypothesis

This detection identifies the presence of a specific digital certificate associated with the Careto malware, signaling potential malicious activity where adversaries leverage trusted signing credentials to evade standard security controls. A proactive hunt for this indicator in Azure Sentinel is essential to uncover stealthy infections that may bypass traditional signature-based defenses by masquerading as legitimate software through valid code signing.

YARA Rule

rule cert_blocklist_0e808f231515bc519eea1a73cdf3266f {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing Careto malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "TecSystem Ltd." and
            pe.signatures[i].serial == "0e:80:8f:23:15:15:bc:51:9e:ea:1a:73:cd:f3:26:6f" and
            1468799999 <= pe.signatures[i].not_after
        )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios and their corresponding filters/exclusions for the “Certificate used for digitally signing Careto malware” detection rule:

• Scenario: Legitimate software updates from major vendors (e.g., Microsoft Windows Update, Adobe Acrobat, or Zoom) that utilize the same code-signing certificate infrastructure as the detected Careto malware.

  • Filter/Exclusion: Create a whitelist exclusion for executable paths known to be trusted enterprise applications. For example, exclude C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroRd32.exe and C:\Windows\System32\msiexec.exe from the rule if they are signed by the specific certificate thumbprint identified in the Careto signature.

• Scenario: Scheduled administrative tasks running via Task Scheduler that execute scripts or binaries (e.g., PowerShell scripts for patch management) which inherit the signing certificate of the parent process or deployment tool (such as SCCM/MECM or Intune).

  • Filter/Exclusion: Implement a logic filter to exclude processes spawned by known system administrators or specific service accounts. Add an exclusion condition where Process_Name matches TaskHost.exe and Parent_Process_Name is svchost.exe (specifically the Schedule service), provided the file hash of the executable matches a baseline of known good versions.

• Scenario: Deployment of internal enterprise applications or custom tools developed by the IT department that were signed using an internal PKI certificate which shares a root authority or specific subject name with the Careto malware’s certificate.

  • Filter/Exclusion: Define an exclusion based on the “Issuer” field in the certificate metadata. If the rule triggers on certificates issued by the organization’s internal CA (e.g., CN=Internal Enterprise Root CA), add a condition to ignore alerts where the issuer matches this specific internal root