Tracking a stolen code-signing certificate with osquery
Summary: Trail of Bits describes how 2.27 million Windows computers were infected with malware signed using a stolen certificate from the creators of CCleaner and inserted into its software update mechanism. The post explains that a colleague's pull request added Windows Authenticode code signature verification to osquery through an 'authenticode' table, letting defenders search for executables signed with a known-stolen certificate.
Key Takeaway: A stolen certificate let malware pass as a legitimate vendor update to 2.27 million machines, and the post notes that signing checks carry a 0% chance of false positives once a certificate is known stolen - making certificate-based searches a concrete way to find other infected hosts on your network.
Read the original at Trail of Bits Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026