Certificate used for digitally signing malware.

Hunt Hypothesis

This detection identifies adversaries leveraging valid digital certificates to sign malicious executables, thereby evading signature-based defenses by masquerading as trusted software. Proactive hunting in Azure Sentinel is essential to uncover these stealthy threats that bypass standard security controls and establish persistence within the environment through legitimate-looking artifacts.

YARA Rule

rule cert_blocklist_6767def972d6ea702d8c8a53af1832d3 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Guangzhou typical corner Network Technology Co., Ltd." and
            pe.signatures[i].serial == "67:67:de:f9:72:d6:ea:70:2d:8c:8a:53:af:18:32:d3" and
            1361750400 <= pe.signatures[i].not_after
        )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Certificate used for digitally signing malware” detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise endpoints (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) automatically download and install new virus definition updates daily. These update packages are signed by the vendor’s root certificate, which may be flagged if that specific certificate has a history of signing malware in other contexts or regions.
  • Filter/Exclusion: Exclude processes named MsMpEng.exe (Microsoft Defender) or Cfsensr.exe (CrowdStrike) when they are executing update tasks from trusted vendor domains (e.g., *.microsoft.com, *.crowdstrike.com). Add a filter to ignore alerts where the parent process is the OS Update service (usoc.dll) running as SYSTEM.

• Scenario: Legitimate Software Deployment via Configuration Management

  • Context: IT administrators use tools like Microsoft SCCM (Configuration Manager) or Ansible to push new applications (e.g., Zoom, Adobe Acrobat) to thousands of workstations. The deployment packages are signed by the organization’s internal PKI certificate, which might be shared with a vendor that has previously issued a compromised or malware-signing certificate.
  • Filter/Exclusion: Create an exclusion for processes running under the System or dedicated Service Accounts (e.g., svc-sccm, svc-ansible) on the domain controller or distribution point servers. Filter out alerts where the file path matches known deployment directories, such as C:\Windows\CCM\Logs or C:\ProgramData\Ansible.

• Scenario: Internal CI/CD Pipeline Artifact Signing

  • Context: DevOps teams utilize Azure DevOps or Jenkins pipelines to build and sign internal microservices using