Certificate used for digitally signing malware.

Hunt Hypothesis

This detection identifies adversaries leveraging valid digital certificates to sign malicious executables, a technique often employed to bypass signature-based defenses and establish trust within the environment. Proactively hunting for this behavior in Azure Sentinel is critical because attackers increasingly abuse legitimate certificate authorities to evade initial security controls, requiring analysts to validate the legitimacy of signed binaries beyond their cryptographic validity.

YARA Rule

rule cert_blocklist_77019a082385e4b73f569569c9f87bb8 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "AND LLC" and
            pe.signatures[i].serial == "77:01:9a:08:23:85:e4:b7:3f:56:95:69:c9:f8:7b:b8" and
            1308182400 <= pe.signatures[i].not_after
        )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Certificate used for digitally signing malware” detection rule, including suggested filters and exclusions:

• Scenario: Legitimate Antivirus Engine Updates

  • Context: Enterprise Endpoint Protection solutions (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon) frequently update their virus definition databases. These updates often involve downloading new signature packs signed by the vendor’s certificate, which may have previously been flagged as “used for signing malware” due to shared trust chains or historical reputation issues.
  • Filter/Exclusion: Exclude processes belonging to known security vendors (e.g., C:\Program Files\Microsoft Defender\MsMpEng.exe, C:\ProgramData\CrowdStrike\fsqa.exe) and filter out file paths containing “Definitions” or “Updates”.

• Scenario: Scheduled Patch Deployment via Configuration Management

  • Context: During automated patching windows, tools like SCCM (Microsoft Endpoint Configuration Manager) or Ansible execute scripts to deploy OS patches. These scripts often utilize a certificate that has been flagged in the past because it was used to sign a specific malicious payload during an earlier incident, even though the current deployment is benign.
  • Filter/Exclusion: Create an exclusion based on the user context SYSTEM or specific service accounts (e.g., DOMAIN\SCCM-Deploy-Svc) running scheduled tasks between 02:00 and 04:00 AM, specifically targeting processes like ccmsetup.exe or Ansible-runner.

• Scenario: Internal DevOps Build Pipeline Execution

  • Context: In-house development teams use CI/CD pipelines (e.g., Azure DevOps Agents, Jenkins) to build and sign internal applications. The certificate used for these builds might be a multi-purpose enterprise CA that was also utilized to sign a third-party plugin later identified