Certificate used for digitally signing malware.

Hunt Hypothesis

This detection identifies adversaries leveraging valid digital certificates to sign malicious executables, a tactic designed to evade signature-based defenses and establish trust with endpoint security tools. Proactively hunting for this behavior in Azure Sentinel is critical because attackers increasingly abuse legitimate certificate authorities to bypass initial alerts, requiring analysts to validate the provenance of signed binaries that may otherwise be overlooked due to their low severity classification.

YARA Rule

rule cert_blocklist_32665079c5a5854a6833623ca77ff5ac {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Ohanae" and
            pe.signatures[i].serial == "32:66:50:79:c5:a5:85:4a:68:33:62:3c:a7:7f:f5:ac" and
            1381967999 <= pe.signatures[i].not_after
        )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Certificate used for digitally signing malware” detection rule, along with suggested filters and exclusions:

• Scenario: Antivirus Engine Updates via Scheduled Tasks

  • Context: Enterprise endpoint protection suites (e.g., Microsoft Defender Antivirus, CrowdStrike Falcon) frequently download and install definition updates or engine patches. These binaries are signed by the vendor’s root certificate, which may also be flagged if that specific certificate has been associated with a distinct malware campaign in the threat intelligence feed.
  • Filter/Exclusion: Create an exclusion based on the Process Name (e.g., MpCmdRun.exe, Cfsensservice.exe) and restrict the rule to trigger only when the process is not running under the context of a known update service account (e.g., NT SERVICE\AntivirusService).

• Scenario: Legitimate Software Deployment via Configuration Management Tools

  • Context: IT administrators use tools like Microsoft SCCM (Configuration Manager), Ansible, or Puppet to push new applications or patches across the fleet. These deployment agents often execute installers signed by the software vendor’s certificate. If that certificate is shared with a known malware signature, the deployment activity triggers an alert.
  • Filter/Exclusion: Exclude events where the Parent Process matches the configuration management agent (e.g., CcmExec.exe, Ansible-Runner) and the User Account belongs to the “System” or a dedicated “Deployment Admin” group, rather than an interactive user session.

• Scenario: CI/CD Pipeline Artifact Execution on Build Servers

  • Context: In DevOps environments, build servers (e.g., Jenkins, Azure DevOps Agents) execute scripts and compile code using tools like .NET SDKs or Java compilers. These tools are often signed by the