Signed Executable with Untrusted Certificate Executed from Suspicious Path
Detects signed executable files with untrusted certificates (expired, revoked, or broken chain) that were downloaded from the internet and executed within one hour of being written to a high-risk path such as user temp, AppData, Downloads, or Public directories. An untrusted certificate on a downloaded executable can indicate use of a revoked or stolen code-signing certificate, a technique observed in multiple Iranian APT campaigns including Seedworm/MuddyWater (ref: CyberProof, April 2026) and consistent with CISA advisory AA26-097A. Note: IsTrusted reflects certificate status at time of MDE cloud scan, not real-time revocation status. Files executed before MDE scan completion or before CA revocation may not be detected.
Microsoft Sentinel (KQL)
