The digital certificate has leaked.

Hunt Hypothesis

This rule detects adversary behavior where sensitive digital certificates are exposed to unauthorized access or potential exfiltration, signaling a risk of compromised identity authentication and encrypted traffic interception. A SOC team should proactively hunt for this in Azure Sentinel because leaked certificates can enable attackers to impersonate legitimate services or bypass security controls without triggering immediate high-severity alerts.

YARA Rule

rule cert_blocklist_4f2ef29ca5f96e5777b82c62f34fd3a6 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "The digital certificate has leaked."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Bit9, Inc" and
            pe.signatures[i].serial == "4f:2e:f2:9c:a5:f9:6e:57:77:b8:2c:62:f3:4f:d3:a6" and
            1342051200 <= pe.signatures[i].not_after
        )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “The digital certificate has leaked” detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Certificate Renewal via Automation

  • Context: Automated renewal scripts (e.g., using certbot or PowerShell New-SelfSignedCertificate) executed by the system account during off-hours to refresh internal SSL certificates. These jobs often generate new certificate artifacts that appear as “new” or “leaked” in monitoring logs before being fully propagated.
  • Filter/Exclusion: Exclude alerts where the source process is a known automation tool (e.g., certbot.exe, powershell.exe) running under the SYSTEM or LocalService account, specifically during maintenance windows (e.g., 02:00–04:00 UTC).

• Scenario: CI/CD Pipeline Artifact Generation

  • Context: During a build and deployment cycle in tools like Jenkins, GitLab CI, or Azure DevOps, the pipeline generates temporary digital certificates for containerized microservices to establish secure communication between stages. These ephemeral certificates are often flagged as leaks because they exist briefly outside the standard production scope.
  • Filter/Exclusion: Filter out events where the hostname matches the pattern of build agents (e.g., *-jenkins-agent, *-ci-runner) and the certificate validity period is less than 24 hours, indicating a temporary build artifact rather than a persistent leak.

• Scenario: Admin-Initiated Certificate Deployment via Group Policy

  • Context: Enterprise administrators use Microsoft SCCM or Intune to push new root CA certificates to thousands of endpoints simultaneously. The mass distribution triggers individual “certificate created” events on each endpoint, which the rule interprets as a potential leak due to the high volume and sudden appearance of the certificate across