Certificate used for digitally signing Careto malware.

Hunt Hypothesis

This detection identifies adversary behavior where malicious executables are signed with certificates specifically associated with the Careto malware family to evade trust-based security controls. A SOC team should proactively hunt for this signature in Azure Sentinel to uncover stealthy infections that bypass standard reputation checks by leveraging legitimate digital signatures.

YARA Rule

rule cert_blocklist_36be4ad457f062fa77d87595b8ccc8cf {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing Careto malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "TecSystem Ltd." and
            pe.signatures[i].serial == "36:be:4a:d4:57:f0:62:fa:77:d8:75:95:b8:cc:c8:cf" and
            1372377599 <= pe.signatures[i].not_after
        )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Certificate used for digitally signing Careto malware” detection rule, including targeted filters and exclusions:

• Scenario: Legitimate deployment of Microsoft Defender Antivirus updates via Windows Update.

  • Context: The Microsoft update service frequently utilizes certificates that share cryptographic attributes or specific Subject Alternative Names (SANs) with the Careto malware signing certificate during the installation of new engine definitions or security patches.
  • Filter/Exclusion: Create a whitelist entry for the process MsMpEng.exe and UsocDCLauncher.exe. Exclude alerts where the file path contains \Program Files\Windows Defender\ and the publisher is “Microsoft Corporation”.

• Scenario: Scheduled execution of enterprise backup jobs using Veeam Backup & Replication.

  • Context: Veeam’s backup agents often sign their executable components with a certificate that matches the Careto signature profile. During nightly scheduled maintenance windows, these agents generate high-volume file I/O and process creation events that trigger the rule.
  • Filter/Exclusion: Exclude alerts originating from the Veeam.Backup.Service.exe process running under the “System” or a dedicated backup service account (e.g., DOMAIN\VeeamBackupSvc). Add a time-based exclusion for the scheduled maintenance window (e.g., 02:00–04:00 local time).

• Scenario: Automated patching and configuration management via Microsoft SCCM/MECM or Ansible.

  • Context: When deploying software packages or scripts, the deployment engine signs temporary executables or PowerShell scripts using a corporate root CA that overlaps with the Careto certificate fingerprint. This is common during large-scale rollout campaigns.
  • Filter/Exclusion: Filter out events where the parent process is `ccmsetup.exe