Repeated Command Line Activity Related to Signing or Certificates

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

This rule detects repeated command-line executions that contain keywords 'signing' or 'certificate' within a one-hour window on the same computer and by the same account. This behavior could indicate an adversary attempting to manipulate code signing, bypass certificate validation, or otherwise interfere with security mechanisms. The threshold of 3 or more occurrences within an hour aims to reduce false positives from legitimate, infrequent activities.