Certificate used for digitally signing malware.

Hunt Hypothesis

This detection identifies adversaries leveraging legitimate digital certificates to sign and obfuscate malicious executables, thereby evading signature-based defenses that trust valid code signatures. Proactively hunting for this behavior in Azure Sentinel is critical to uncovering supply chain compromises or living-off-the-land attacks where attackers abuse trusted identities to establish persistence without triggering immediate high-severity alerts.

YARA Rule

rule cert_blocklist_29f42680e653cf8fafd0e935553f7e86 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Wemade Entertainment co.,Ltd" and
            pe.signatures[i].serial == "29:f4:26:80:e6:53:cf:8f:af:d0:e9:35:55:3f:7e:86" and
            1390175999 <= pe.signatures[i].not_after
        )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios and their corresponding filters/exclusions for the “Certificate used for digitally signing malware” detection rule:

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise endpoint protection suites (e.g., Microsoft Defender, CrowdStrike Falcon) automatically download and install new virus definition packages daily. These updates are often signed by the vendor’s root certificate, which may also be used to sign known malware samples in the threat intelligence database. The detection logic might flag the update process itself as suspicious because it involves a certificate associated with “malware signing.”
  • Filter/Exclusion: Exclude processes matching MsMpEng.exe (Microsoft Defender) or FalconSensorService.exe (CrowdStrike) when they are running under the context of scheduled tasks named Antivirus Update or Definition Sync. Add a condition to ignore alerts where the file path contains \Program Files\Windows Defender\ or \Program Files\CrowdStrike\.

• Scenario: Deployment of Enterprise-Wide Security Patches via SCCM/Intune

  • Context: During Windows Update cycles managed by System Center Configuration Manager (SCCM) or Microsoft Intune, the deployment client (ccmexec.exe or Microsoft.IntuneManagementExtension) executes scripts to apply patches. These scripts are often signed with a corporate CA certificate that is also used in the threat intelligence feed for malware signatures. The rule may trigger when these legitimate patching agents execute code signing verification routines.
  • Filter/Exclusion: Create an exclusion for process names ccmexec.exe and Microsoft.IntuneManagementExtension running under the SYSTEM or specific service accounts (e.g., DOMAIN\SCCM-Service-Account). Additionally, filter out events where the parent process is TaskHostW.exe associated with the “Windows Update” scheduled job.