Execution via Signed Binary

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Execution via Signed Binary

Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Adversaries may use these binaries to live off the land and execute malicious files that could bypass application whitelisting and signature validation.

Rule indices:

winlogbeat-*

Severity: low

Risk score: 21

Runs every: 5 minutes

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum signals per execution: 100

Tags:

Elastic
Windows

Rule version: 1

Added (Elastic Stack release): 7.6.0

Potential false positives

edit

Security testing may produce events like this. Activity of this kind performed by non-engineers and ordinary users is unusual.

Rule query

edit

event.code:1 and http and (process.name:certutil.exe or
process.name:msiexec.exe)

Threat mapping

edit

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
Technique:
- Name: Signed Binary Proxy Execution
- ID: T1218
- Reference URL: https://attack.mitre.org/techniques/T1218/
Tactic:
- Name: Execution
- ID: TA0002
- Reference URL: https://attack.mitre.org/tactics/TA0002/
Technique:
- Name: Signed Binary Proxy Execution
- ID: T1218
- Reference URL: https://attack.mitre.org/techniques/T1218/

« Encoding or Decoding Files via CertUtil Exploit - Detected - Elastic Endpoint »