Certificate used for digitally signing Zeus malware.

Hunt Hypothesis

This detection identifies the presence of digital certificates historically associated with signing the Zeus malware family, signaling potential supply chain compromise or legacy persistence mechanisms within the environment. A proactive hunt is essential in Azure Sentinel to validate whether these specific certificates are actively authenticating legitimate traffic or if they represent a stealthy adversary leveraging trusted identities to evade standard signature-based defenses.

YARA Rule

rule cert_blocklist_75a38507bf403b152125b8f5ce1b97ad {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing Zeus malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "isonet ag" and
            pe.signatures[i].serial == "75:a3:85:07:bf:40:3b:15:21:25:b8:f5:ce:1b:97:ad" and
            1395359999 <= pe.signatures[i].not_after
        )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios and their corresponding filters/exclusions for the “Certificate used for digitally signing Zeus malware” detection rule:

• Scenario: Legitimate deployment of Microsoft Office updates via System Center Configuration Manager (SCCM) or Windows Update.

  • Context: Many enterprise environments use certificates issued by Digicert or Sectigo that overlap with those historically associated with the Zeus banking trojan to sign legitimate Office 365 and Outlook patches. When these updates install, they trigger the rule because the signing certificate matches the known Zeus signature.
  • Filter/Exclusion: Exclude processes where ProcessName is Setup.exe, OfficeC2RClient.exe, or Microsoft.Update.Agent.exe AND the Publisher contains “Microsoft Corporation”. Additionally, filter out events occurring during defined maintenance windows (e.g., 01:00–04:00 UTC) on known update servers.

• Scenario: Scheduled execution of internal DevOps build pipelines using Azure DevOps or Jenkins agents.

  • Context: Internal CI/CD agents often sign custom deployment scripts, container images, or configuration files using a corporate root CA that shares the same Subject Name or Thumbprint as the Zeus malware certificate. When these agents execute nightly builds or release deployments, they generate digital signature events that mimic the Zeus profile.
  • Filter/Exclusion: Create an exclusion for ProcessName matching known build agents (e.g., msbuild.exe, java.exe, dotnet.exe) running on specific hostnames containing “BUILD-SRV” or “JENKINS-AGENT”. Ensure the filter checks that the CommandLine contains keywords like “—publish”, “—deploy”, or internal repository URLs.

• Scenario: Automated backup and archival operations performed by Veeam Backup & Replication or Commvault.

  • Context: Enterprise backup