The digital certificate has leaked.

Hunt Hypothesis

This detection rule identifies instances where a digital certificate containing sensitive authentication credentials has been exposed or compromised within the environment. A proactive hunt is essential in Azure Sentinel to verify the scope of this leak and prevent adversaries from leveraging these certificates for unauthorized access or man-in-the-middle attacks before they escalate into higher-severity incidents.

YARA Rule

rule cert_blocklist_7cc1db2ad0a290a4bfe7a5f336d6800c {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "The digital certificate has leaked."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Bit9, Inc" and
            pe.signatures[i].serial == "7c:c1:db:2a:d0:a2:90:a4:bf:e7:a5:f3:36:d6:80:0c" and
            1342051200 <= pe.signatures[i].not_after
        )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “The digital certificate has leaked” detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Certificate Renewal via PowerShell Scripts

  • Context: Scheduled maintenance jobs (e.g., running via Windows Task Scheduler or Azure Automation) use Invoke-WebRequest or certutil.exe to fetch and validate new certificates from internal PKI servers. These scripts often export certificate details to logs, which the rule interprets as a potential leak of sensitive certificate data.
  • Filter/Exclusion: Create an exclusion based on the process name (powershell.exe, taskeng.exe) and command line arguments containing specific keywords like /renew or certutil -viewstore. Additionally, whitelist the source IP addresses of known internal PKI servers (e.g., 10.20.x.x).

• Scenario: CI/CD Pipeline Artifact Generation

  • Context: During deployment pipelines in tools like Jenkins, GitLab CI, or GitHub Actions, build agents frequently download and process digital certificates to sign artifacts or configure secure connections for staging environments. The ingestion of these certificate files into the pipeline workspace triggers the rule as a data exfiltration event.
  • Filter/Exclusion: Exclude events originating from specific service accounts used by CI/CD tools (e.g., svc-jenkins-build, gitlab-runner) and restrict the scope to traffic destined for internal artifact repositories (e.g., Nexus, Artifactory) rather than external public IPs.

• Scenario: Endpoint Security Agent Health Checks

  • Context: Enterprise endpoint protection suites like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec Endpoint Protection perform routine health checks that involve querying and transmitting certificate chain information to the central management console. This telemetry traffic is often flagged as a certificate leak when the agent