Invalid Code Signature

DeviceFileCertificateInfo
| where Timestamp > ago(24h)
| where IsRootSignerMicrosoft == false or SignatureState != "Valid"
| where isnotempty(Signer)
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where isnotempty(SHA1)
) on $left.SHA1 == $right.SHA1
| where SignatureState in ("Invalid", "Untrusted", "Expired", "Revoked")
| project Timestamp, DeviceName, FileName, FolderPath, Signer, SignatureState, IsTrusted,
         ProcessCommandLine, InitiatingProcessFileName, AccountName
| sort by Timestamp desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7
| where SignatureStatus!="Valid"
| where isnotnull(Signature) AND Signature!="?"
| eval SignedButInvalid=if(SignatureStatus IN ("Invalid", "Expired", "Revoked", "Untrusted"), 1, 0)
| where SignedButInvalid=1
| stats count as Executions, values(SignatureStatus) as SigStatus, dc(host) as Hosts by Image, Signature, Signed
| where Executions < 10
| sort - Executions

sequence by process.entity_id
  [library where process.code_signature.status != "trusted" and
   process.code_signature.exists == true and
   process.code_signature.status in ("error", "expired", "revoked", "untrusted") and
   process.code_signature.subject_name != null and
   process.code_signature.subject_name != ""
  ]
  [process where event.type == "start" and
   process.code_signature.exists == true and
   process.code_signature.status != "trusted" and
   process.code_signature.status in ("error", "expired", "revoked", "untrusted") and
   not process.name in ("MicrosoftEdgeUpdate.exe", "MsiExec.exe")
  ]

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
       sourceip,
       "hostname",
       username,
       "filename",
       "filepath",
       QIDNAME(qid) AS EventName,
       "SignatureStatus",
       "Signer",
       "CommandLine"
FROM events
WHERE LOGSOURCETYPEID IN (65, 1263)
  AND QIDNAME(qid) LIKE '%Image Load%'
  AND "SignatureStatus" IS NOT NULL
  AND "SignatureStatus" NOT LIKE 'Valid'
  AND "SignatureStatus" IN ('Invalid', 'Expired', 'Revoked', 'Untrusted')
  AND "Signer" IS NOT NULL
  AND "Signer" NOT LIKE ''
  AND starttime > (NOW() - 86400000)
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=windows/sysmon OR _sourceCategory=OS/Windows/Sysmon
| where EventID = "7"
| json field=_raw "SignatureStatus", "Signature", "Signed", "Image", "Computer", "User", "CommandLine" nodrop
| where !isNull(Signature) AND Signature != "?" AND Signature != ""
| where SignatureStatus in ("Invalid", "Expired", "Revoked", "Untrusted")
| eval SignedButInvalid = if(SignatureStatus in ("Invalid", "Expired", "Revoked", "Untrusted"), 1, 0)
| where SignedButInvalid = 1
| stats count as Executions, values(SignatureStatus) as SigStatus, dcount(Computer) as Hosts by Image, Signature, Signed
| where Executions < 10
| sort by Executions desc

rule invalid_code_signature_t1036_001 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects process execution or image load events where a code signature is present but in an invalid, expired, revoked, or untrusted state, indicating potential T1036.001 masquerading activity."
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1036.001"
    severity = "HIGH"
    confidence = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1036/001/"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.file.authenticode_hash.sha256 != ""
    $e.target.process.file.pe.signature_present = true
    $e.target.process.file.pe.is_signed = true
    (
      $e.target.process.file.pe.signature_type = "INVALID" or
      $e.target.process.file.pe.signature_type = "EXPIRED" or
      $e.target.process.file.pe.signature_type = "REVOKED" or
      $e.target.process.file.pe.signature_type = "UNTRUSTED"
    )
    $e.target.process.file.pe.issuer != ""
    not $e.principal.hostname = ""

    $host = $e.principal.hostname
    $image = $e.target.process.file.full_path
    $signer = $e.target.process.file.pe.issuer
    $sigstate = $e.target.process.file.pe.signature_type

  condition:
    $e
}

#event_simpleName = "ProcessRollup2" OR #event_simpleName = "SyntheticProcessRollup2"
| ImageFileName = /./
| SignInfoFlags != "0"
| SignInfoFlags = /(?:invalid|expired|revoked|untrusted)/i
OR (
  #event_simpleName = "ClassifiedModuleLoad"
  | SignInfoFlags != "0"
  | ImageFileName != ""
  | SignInfoFlags = /(?:invalid|expired|revoked)/i
)
| groupBy([ComputerName, ImageFileName, SignInfoFlags, SHA256HashData], function=[
    count(aid, as=ExecutionCount),
    collectDistinct(UserName, as=Users),
    collectDistinct(CommandLine, as=CommandLines)
  ])
| ExecutionCount < 10
| sort(ExecutionCount, order=asc)