Certificate used for digitally signing malware.

Hunt Hypothesis

This detection identifies adversaries leveraging valid digital certificates to sign malicious executables, a tactic often employed to bypass signature-based defenses and establish trust within the environment. Proactive hunting in Azure Sentinel is essential because attackers frequently abuse legitimate certificate authorities to evade initial security controls, necessitating deep inspection of signing metadata to uncover stealthy malware campaigns that standard alerts might overlook.

YARA Rule

rule cert_blocklist_1121ed568764e75be35574448feadefcd3bc {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "FRINORTE COMERCIO DE PECAS E SERVICOS LTDA - ME" and
            pe.signatures[i].serial == "11:21:ed:56:87:64:e7:5b:e3:55:74:44:8f:ea:de:fc:d3:bc" and
            1385337599 <= pe.signatures[i].not_after
        )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the detection rule “Certificate used for digitally signing malware,” including suggested filters and exclusions:

• Scenario: Automated Patch Deployment via Microsoft Endpoint Configuration Manager (SCCM)

  • Context: The SCCM client service (ccmexec.exe) or the Windows Update agent frequently downloads and executes signed updates from third-party vendors. If a specific vendor’s certificate has historically been flagged for malware in other environments, legitimate patch installations may trigger this rule.
  • Filter/Exclusion: Create an exclusion based on the parent process C:\Windows\CCM\PolicyAgent.exe or C:\Windows\System32\usoc.dll. Additionally, exclude specific known-good certificate issuers (e.g., “Microsoft Corporation” or “Adobe Systems Incorporated”) that are trusted within your enterprise PKI.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: During nightly maintenance windows, the endpoint protection suite (e.g., CrowdStrike Falcon, Symantec Endpoint Protection, or Microsoft Defender) downloads new definition signatures. The update engine often uses a specific signing certificate to verify these packages before execution. If this certificate has been previously associated with a malware family in the threat intelligence feed, legitimate updates will generate alerts.
  • Filter/Exclusion: Exclude processes running under the “System” account within the C:\ProgramData\Microsoft\Crypto or specific vendor directories (e.g., C:\Program Files\McAfee\Agent). Implement a time-based filter to suppress alerts for these specific certificate hashes during defined maintenance windows (e.g., 02:00–04:00 local time).

• Scenario: Legacy Line-of-Business Application Deployment

  • Context: Internal IT teams deploy custom line-of-business applications using installers signed by an internal or niche third-party certificate