Certificate used for digitally signing malware.

Hunt Hypothesis

This detection identifies adversaries leveraging valid digital certificates to sign malicious executables, a tactic designed to bypass signature-based security controls and evade initial threat detection. Proactively hunting for this behavior in Azure Sentinel is critical to uncover stealthy attacks where trusted credentials are abused to establish persistence or deliver payloads that traditional antivirus solutions might incorrectly classify as benign.

YARA Rule

rule cert_blocklist_4531954f6265304055f66ce4f624f95b {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "IDAutomation.com" and
            pe.signatures[i].serial == "45:31:95:4f:62:65:30:40:55:f6:6c:e4:f6:24:f9:5b" and
            1384819199 <= pe.signatures[i].not_after
        )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Certificate used for digitally signing malware,” along with suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Antivirus Engine Updates via Trusted Vendors

  • Context: Major security vendors (e.g., Microsoft Defender, Symantec, CrowdStrike) frequently update their signature databases or engine binaries using the same certificates that historically signed known malware samples. If a specific certificate was previously flagged for a legacy threat but is now used by a trusted vendor’s updater service, legitimate updates may trigger this rule.
  • Filter/Exclusion: Exclude processes where the Publisher matches trusted security vendors (e.g., “Microsoft Corporation”, “CrowdStrike Holdings, Inc.”) and the file path resides in standard installation directories like C:\Program Files\Windows Defender or C:\ProgramData\CrowdStrike.

• Scenario: Scheduled PowerShell Script Execution by Admins

  • Context: Enterprise administrators often deploy scheduled tasks (via Task Scheduler) that execute .ps1 scripts to perform routine maintenance, patching, or reporting. These scripts are frequently signed with a corporate internal CA certificate. If this specific internal certificate was previously associated with a malware signature in the threat intelligence feed, legitimate admin automation jobs will trigger false alarms.
  • Filter/Exclusion: Create an exclusion for processes launched by powershell.exe where the Parent Process Name is Task Scheduler Service (svchost.exe) and the script path contains \Scripts\ or \Automation\, provided the certificate issuer is “Internal Enterprise Root CA”.

• Scenario: CI/CD Pipeline Artifact Deployment

  • Context: DevOps pipelines (e.g., Jenkins, Azure DevOps) often deploy application binaries to production servers. The deployment agents sign these artifacts using a shared build server certificate. If