locate-files-possibly-signed-by-fraudulent-ecc-certificates

Description

This query was originally published in the threat analytics report, CVE-2020-0601 certificate validation vulnerability. The Windows CryptoAPI Spoofing Vulnerability, CVE-2020-0601, can be exploited to spoof code-signing certificates. For example, an attacker could forge a certificate that lists Microsoft as the issuer. This would allow an attacker to disguise a malicious executable as legitimate. The vulnerability was patched with the January 2020 Security Update. Use the following query to locate files containing ECC certificates that might have been forged using this vulnerability. The query identifies files that don't correctly identify the signer name, yet list Microsoft as the root signer. References: https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2020-0601 https://portal.msrc.microsoft.com/security-guidance/releasenotedetail/2020-Jan

Query · kql

DeviceFileCertificateInfo
| where Timestamp > ago(30d)
| where IsSigned == 1 and IsTrusted == 1 and IsRootSignerMicrosoft == 1
| where SignatureType == "Embedded"
| where Issuer !startswith "Microsoft" and Issuer !startswith "Windows"
| project Timestamp, DeviceName,SHA1,Issuer,IssuerHash,Signer,SignerHash,
CertificateCreationTime,CertificateExpirationTime,CrlDistributionPointUrls
Raw source locate-files-possibly-signed-by-fraudulent-ecc-certificates · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: d8f2e268-68a6-4f09-abd1-2568462bcaf5
name: locate-files-possibly-signed-by-fraudulent-ecc-certificates
description: |
  This query was originally published in the threat analytics report, CVE-2020-0601 certificate validation vulnerability.
  The Windows CryptoAPI Spoofing Vulnerability, CVE-2020-0601, can be exploited to spoof code-signing certificates. For example, an attacker could forge a certificate that lists Microsoft as the issuer. This would allow an attacker to disguise a malicious executable as legitimate.
  The vulnerability was patched with the January 2020 Security Update.
  Use the following query to locate files containing ECC certificates that might have been forged using this vulnerability. The query identifies files that don't correctly identify the signer name, yet list Microsoft as the root signer.
  References:
  https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2020-0601
  https://portal.msrc.microsoft.com/security-guidance/releasenotedetail/2020-Jan
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileCertificateInfo
tactics:
- Defense evasion
query: |
  DeviceFileCertificateInfo
  | where Timestamp > ago(30d)
  | where IsSigned == 1 and IsTrusted == 1 and IsRootSignerMicrosoft == 1
  | where SignatureType == "Embedded"
  | where Issuer !startswith "Microsoft" and Issuer !startswith "Windows"
  | project Timestamp, DeviceName,SHA1,Issuer,IssuerHash,Signer,SignerHash,
  CertificateCreationTime,CertificateExpirationTime,CrlDistributionPointUrls

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.