DigitalSignature Check

Hunt Hypothesis

This rule identifies potential tampering or unauthorized modifications to digital assets by flagging instances where digital signature validation fails, indicating that an adversary may have altered code or data to hide their presence. Proactively hunting for these anomalies in Azure Sentinel allows the SOC to detect subtle supply chain attacks or insider threats before they escalate into significant security incidents.

YARA Rule

rule HasDigitalSignature : PECheck
{
	meta: 
		author="_pusher_"
		description = "DigitalSignature Check"
		date="2016-07"
	strings:		
		//size check is wildcarded
		$a0 = { ?? ?? ?? ?? 00 02 02 00 30 82 ?? ?? 06 09 2A 86 48 86 F7 0D 01 07 02 A0 82 ?? ?? 30 82 ?? ?? 02 01 01 31 0B 30 09 06 05 2B 0E 03 02 1A 05 00 30 68 06 0A 2B 06 01 04 01 82 37 02 01 04 A0 5A 30 58 30 33 06 0A 2B 06 01 04 01 82 37 02 01 0F 30 25 03 01 00 A0 20 A2 1E 80 1C 00 3C 00 3C 00 3C 00 4F 00 62 00 73 00 6F 00 6C 00 65 00 74 00 65 00 3E 00 3E 00 3E 30 21 30 09 06 05 2B 0E 03 02 1A 05 00 04 14 }
		$a1 = { ?? ?? ?? ?? 00 02 02 00 30 82 ?? ?? 06 09 2A 86 48 86 F7 0D 01 07 02 A0 82 ?? ?? 30 82 ?? ?? 02 01 01 31 0B 30 09 06 05 2B 0E 03 02 1A 05 00 30 ?? 06 0A 2B 06 01 04 01 82 37 02 01 04 A0 ?? 30 ?? 30 ?? 06 0A 2B 06 01 04 01 82 37 02 01 0F 30 ?? 03 01 00 A0 ?? A2 ?? 80 00 30 21 30 09 06 05 2B 0E 03 02 1A 05 00 04 14 }
		$a2 = { ?? ?? ?? ?? 00 02 02 00 30 82 ?? ?? 06 09 2A 86 48 86 F7 0D 01 07 02 A0 82 ?? ?? 30 82 ?? ?? 02 01 01 31 0E 30 ?? 06 ?? ?? 86 48 86 F7 0D 02 05 05 00 30 67 06 0A 2B 06 01 04 01 82 37 02 01 04 A0 59 30 57 30 33 06 0A 2B 06 01 04 01 82 37 02 01 0F 30 25 03 01 00 A0 20 A2 1E 80 1C 00 3C 00 3C 00 3C 00 4F 00 62 00 73 00 6F 00 6C 00 65 00 74 00 65 00 3E 00 3E 00 3E 30 20 30 0C 06 08 2A 86 48 86 F7 0D 02 05 05 00 04 }
		$a3 = { ?? ?? ?? ?? 00 02 02 00 30 82 ?? ?? 06 09 2A 86 48 86 F7 0D 01 07 02 A0 82 ?? ?? 30 82 ?? ?? 02 01 01 31 0F 30 ?? 06 ?? ?? 86 48 01 65 03 04 02 01 05 00 30 78 06 0A 2B 06 01 04 01 82 37 02 01 04 A0 6A 30 68 30 33 06 0A 2B 06 01 04 01 82 37 02 01 0F 30 25 03 01 00 A0 20 A2 1E 80 1C 00 3C 00 3C 00 3C 00 4F 00 62 00 73 00 6F 00 6C 00 65 00 74 00 65 00 3E 00 3E 00 3E 30 31 30 0D 06 09 60 86 48 01 65 03 04 02 01 05 00 04 }
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint32(uint32(0x3C)) == 0x00004550 and
		(for any of ($a*) : ($ in ( (pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size)..filesize)) )
		//its not always like this:
		//and  uint32(@a0) == (filesize-(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Automated deployment pipelines (e.g., Azure DevOps, Jenkins, or GitHub Actions) executing signtool or sigcheck to verify code integrity before promoting artifacts to production.
  • Filter/Exclusion: Exclude processes where the parent process is a known CI/CD agent (e.g., vstsagent.exe, jenkins-agent.jar, dockerd.exe) or where the command line contains specific flags like /v (verify) or /pa (public key algorithm) without accompanying write operations.
• Scenario: Enterprise backup solutions (e.g., Veeam, Commvault, or Acronis) performing pre-backup integrity checks on virtual machine images or database files using fsutil or custom PowerShell scripts.
  • Filter/Exclusion: Exclude execution from service accounts associated with backup infrastructure (e.g., svc-backup, vss-writer) or filter by process names like vssadmin.exe, wbadmin.exe, or fsutil.exe when the parent process is a backup service host.
• Scenario: Windows Update or Patch Tuesday automation scripts (e.g., PDQ Deploy, SCCM/MECM task sequences) validating the digital signatures of downloaded .msi or .exe packages before installation.
  • Filter/Exclusion: Exclude processes running under the TrustedInstaller service or where the parent process is wuaexehost.exe, wuauclt.exe, or SCCM agents (CCMExec.exe, CCMSetup.exe).
• Scenario: Application installers (e.g., MSIExec, NSIS, or Inno Setup) verifying the signature of the installer package itself during the initial extraction phase.
  • Filter/Exclusion: Exclude events where the process name is msiexec.exe or `un