Certificate used for digitally signing malware.

Hunt Hypothesis

This detection identifies adversaries leveraging valid digital certificates to sign malicious executables, thereby evading signature-based defenses by mimicking trusted software behavior. Proactive hunting in Azure Sentinel is essential because attackers increasingly abuse legitimate certificate authorities to establish persistence and bypass initial security controls that rely heavily on code signing validation.

YARA Rule

rule cert_blocklist_1f4c22da1107d20c1eda04569d58e573 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "PlanView, Inc." and
            pe.signatures[i].serial == "1f:4c:22:da:11:07:d2:0c:1e:da:04:56:9d:58:e5:73" and
            1366156799 <= pe.signatures[i].not_after
        )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Certificate used for digitally signing malware,” along with suggested filters or exclusions:

• Legitimate Software Deployment via Package Managers

  • Scenario: Automated deployment tools like Microsoft Endpoint Configuration Manager (SCCM) or Chocolatey install software packages that are signed by a certificate previously flagged as malicious. The installation process involves the execution of the installer (e.g., msiexec.exe or choco.exe) which triggers the rule because the installer’s signature matches the “malware” certificate, even though the specific package being installed is benign in this context.
  • Filter/Exclusion: Exclude processes where the parent process is a known deployment tool (e.g., ccmexec.exe, choco.exe) and the file path resides within the organization’s designated software distribution folder (e.g., C:\ProgramData\Microsoft\Intune\ or C:\Chocolatey\).

• Scheduled Antivirus Definition Updates

  • Scenario: The enterprise antivirus solution (e.g., CrowdStrike Falcon, SentinelOne, or Symantec Endpoint Protection) performs a scheduled update of its detection engine. These updates are often signed by the vendor’s root certificate, which may have been flagged in global threat intelligence feeds due to a past compromise or specific malware strain associated with that same certificate ID.
  • Filter/Exclusion: Create an exclusion for processes running under the SYSTEM account during defined maintenance windows (e.g., 02:00–04:00 local time) where the executable path matches known AV update services (e.g., C:\Program Files\CrowdStrike\Falcon\csfalcon.exe).

• CI/CD Pipeline Artifact Signing

  • Scenario: In a DevOps environment, internal build servers