compromised NVIDIA certificates[Lapsus$]

id: fa2db236-b846-45b7-b161-00da96717051
name: compromised NVIDIA certificates[Lapsus$]
description: |
  Search for the files that are using a compromised certificate associated with the Lapsus$ group.
  You can remove the comments to:
  1. get the list of devices where there is at least one file signed with the certificate
  2. get the list of files signed with the certificate
  3. get the list of files signed with the certificate group by Devices
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileCertificateInfo
  - DeviceFileEvents
tactics:
- Privilege escalation
- Vulnerability
tags:
- Lapsus$
- Nvidia
query: |
 DeviceFileCertificateInfo
 | where CertificateSerialNumber == "43BB437D609866286DD839E1D00309F5" or CertificateSerialNumber == "14781bc862e8dc503a559346f5dcc518"
 | join DeviceFileEvents on SHA1
 | distinct DeviceName, FileName, FolderPath, SHA1, SHA256, IsTrusted, IsRootSignerMicrosoft, SignerHash
  //| distinct DeviceName
  //| distinct FileName
  //| summarize mylist = make_list(FileName) by DeviceName