Detect Code Signing in Microsoft Sentinel
Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Valid signatures can bypass security policies requiring signed code to execute, making this technique effective for defense evasion. Threat actors including FIN7, Scattered Spider, Kimsuky, and Patchwork have all leveraged purchased, stolen, or self-signed certificates to make malicious binaries appear legitimate.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1553 Subvert Trust Controls
- Sub-technique
- T1553.002 Code Signing
- Canonical reference
- https://attack.mitre.org/techniques/T1553/002/
KQL Detection Query
let SuspiciousSigntoolPatterns = dynamic([
"/sign", "-sign",
"/f ", "-f ",
"/p ", "-p ",
"/fd ", "-fd ",
"/tr ", "-tr ",
"sha256", "sha1"
]);
let CertToolPatterns = dynamic([
"-addstore", "-addcert",
"-importpfx", "-p12",
"MY", "Root", "TrustedPublisher"
]);
// Detection 1: signtool.exe invocations from non-standard parent processes
let SigntoolDetection = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "signtool.exe"
| where ProcessCommandLine has_any (SuspiciousSigntoolPatterns)
| extend SuspiciousParent = InitiatingProcessFileName has_any (
"cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe",
"cscript.exe", "mshta.exe", "rundll32.exe", "explorer.exe"
)
| extend SigningPFX = ProcessCommandLine has_any (".pfx", ".p12")
| extend TimestampServer = ProcessCommandLine has "/tr" or ProcessCommandLine has "-tr"
| extend SelfSigned = ProcessCommandLine !has "/tr" and ProcessCommandLine !has "-tr"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
SuspiciousParent, SigningPFX, TimestampServer, SelfSigned
| extend DetectionType = "SigntoolExecution";
// Detection 2: certutil importing certificates into trusted stores
let CertutilDetection = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "certutil.exe"
| where ProcessCommandLine has_any (CertToolPatterns)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine
| extend DetectionType = "CertutilCertImport"
| extend SuspiciousParent = InitiatingProcessFileName has_any (
"cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe"
)
| extend SigningPFX = ProcessCommandLine has_any (".pfx", ".p12")
| extend TimestampServer = false
| extend SelfSigned = false;
// Detection 3: pfx/p12 certificate files created in suspicious locations
let CertFileCreation = DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName endswith ".pfx" or FileName endswith ".p12" or FileName endswith ".cer" or FileName endswith ".crt"
| where FolderPath has_any ("Temp", "Downloads", "AppData\\Local", "AppData\\Roaming", "Users\\Public", "ProgramData")
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, FolderPath,
InitiatingProcessFileName, InitiatingProcessCommandLine
| extend DetectionType = "SuspiciousCertFileCreation"
| extend SuspiciousParent = true
| extend SigningPFX = true
| extend TimestampServer = false
| extend SelfSigned = false
| project-rename AccountName = InitiatingProcessAccountName;
// Detection 4: Registry modifications to trusted publisher or root CA stores
let CertStoreModification = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where ActionType == "RegistryValueSet"
| where RegistryKey has_any (
"ROOT\\Certificates",
"TrustedPublisher\\Certificates",
"AuthRoot\\Certificates",
"HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT",
"HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\TrustedPublisher"
)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName,
InitiatingProcessFileName, InitiatingProcessCommandLine
| extend DetectionType = "CertStoreRegistryMod"
| extend SuspiciousParent = InitiatingProcessFileName !in~ ("certutil.exe", "mmc.exe", "wuauclt.exe", "TrustedInstaller.exe", "svchost.exe")
| extend SigningPFX = false
| extend TimestampServer = false
| extend SelfSigned = false
| project-rename AccountName = InitiatingProcessAccountName;
union isfuzzy=true SigntoolDetection, CertutilDetection, CertStoreModification
| sort by Timestamp descDetects code signing certificate abuse across four detection surfaces: (1) signtool.exe invocations from scripting engines or suspicious parent processes that may indicate automated signing of malicious payloads; (2) certutil.exe importing PFX/P12 certificates or modifying trusted stores; (3) certificate files (.pfx/.p12/.cer) created in user-writable temporary directories; (4) direct registry modifications to Windows trusted root CA or trusted publisher certificate stores. Uses DeviceProcessEvents, DeviceFileEvents, and DeviceRegistryEvents tables from Microsoft Defender for Endpoint.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate software developers signing their builds using signtool.exe in CI/CD pipelines (Azure DevOps, Jenkins build agents) — parent processes may be cmd.exe or powershell.exe in these environments
- Certificate authority and PKI administrators importing new root or intermediate CA certificates via certutil.exe or mmc.exe as part of enterprise PKI management
- Software installers bundled with vendor-signed binaries that import product-specific root certificates during installation (e.g., corporate VPN clients, enterprise security products)
- Automated patch management solutions (WSUS, SCCM) that update trusted root certificate stores as part of Windows Update processes
- Security scanning tools that create temporary certificate files when testing SSL/TLS configurations
Other platforms for T1553.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create and Use a Self-Signed Code Signing Certificate
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with New-SelfSignedCertificate in command line. Sysmon Event ID 1: Process Create for signtool.exe with command line containing '/sign', '/f', '.pfx', '/fd sha256', and the target binary path. Sysmon Event ID 11: File creation events for df00tech-codesign.pfx and df00tech-test.exe in %TEMP%. PowerShell ScriptBlock Log Event ID 4104 with the New-SelfSignedCertificate and Export-PfxCertificate commands.
- Test 2Import Self-Signed Certificate into Trusted Publishers Store
Expected signal: Sysmon Event ID 1: Process Create for certutil.exe with CommandLine containing '-addstore TrustedPublisher'. Sysmon Event ID 11: File creation for df00tech-publisher.cer in %TEMP%. Sysmon Event ID 13 (Registry Value Set): new value under HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\ keyed by the certificate thumbprint. PowerShell ScriptBlock Log Event ID 4104 for the New-SelfSignedCertificate commands.
- Test 3Verify Signed Binary Execution Trust (Authenticode Check Bypass Simulation)
Expected signal: Sysmon Event ID 1: Process Create for certutil.exe with '-addstore -user TrustedPublisher'. Sysmon Event ID 11: File creation events for df00tech-sign-test.cer and df00tech-payload.ps1 in %TEMP%. Sysmon Event ID 13: Registry modification under HKCU\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates (user-store variant). PowerShell ScriptBlock Log Event ID 4104 for Set-AuthenticodeSignature cmdlet execution.
- Test 4macOS Ad-Hoc Code Signing
Expected signal: macOS Unified Log: codesign process execution with '--sign -' arguments visible in process audit logs. Endpoint Security Framework events for ES_EVENT_TYPE_NOTIFY_EXEC when codesign runs. Security.framework log entries in /var/log/system.log for code signing operations. If EDR is present (CrowdStrike, SentinelOne): process creation event for codesign with suspicious ad-hoc signing arguments. spctl execution generates Gatekeeper assessment log entries in /var/log/system.log.
References (11)
- https://attack.mitre.org/techniques/T1553/002/
- https://eclecticlight.co/2020/11/16/checks-on-executable-code-in-catalina-and-big-sur-a-first-draft/
- https://securelist.com/why-you-shouldnt-completely-trust-files-signed-with-digital-certificates/68593/
- http://www.symantec.com/connect/blogs/how-attackers-steal-private-keys-digital-certificates
- https://en.wikipedia.org/wiki/Code_signing
- https://learn.microsoft.com/en-us/windows/win32/seccrypto/signtool
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.002/T1553.002.md
- https://blog.talosintelligence.com/2020/09/cobalt-strike-paper.html
- https://www.crowdstrike.com/blog/scattered-spider-byovd-exploits/
- https://unit42.paloaltonetworks.com/backconfig-malware-targeting-government-military/
Unlock Pro Content
Get the full detection package for T1553.002 including response playbook, investigation guide, and atomic red team tests.