Execution of Binaries Signed by Malicious TrustConnect Certificate

Brandon Rodriguez@BMRodriguez

•updated Mar 16, 2026•6•1•101

Detects the execution of files signed by "TrustConnect Software PTY LTD", a certificate issuer observed signing malware that impersonates legitimate workplace applications to deploy RMM backdoors. This rule identifies processes launched from binaries associated with this suspicious certificate.