diff --git a/yml/OSBinaries/Sigverif.yml b/yml/OSBinaries/Sigverif.yml new file mode 100644 index 00000000..2bd5d1f8 --- /dev/null +++ b/yml/OSBinaries/Sigverif.yml @@ -0,0 +1,29 @@ +--- +Name: Sigverif.exe +Description: File Signature Verification utility to verify digital signatures of files +Author: Moshe Kaplan +Created: 2021-11-08 +Commands: + - Command: sigverif.exe + Description: Launch sigverif.exe GUI, navigate to Advanced settings, specify arbitrary executable path as log file, then click View Log to execute the binary + Usecase: Execute arbitrary programs through a trusted Microsoft-signed binary to bypass application whitelisting + Category: Execute + Privileges: User + MitreID: T1218 + OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 10, Windows 11 + Tags: + - Execute: EXE +Full_Path: + - Path: C:\Windows\System32\sigverif.exe + - Path: C:\Windows\SysWOW64\sigverif.exe +Detection: + - IOC: sigverif.exe spawning unexpected child processes + - IOC: sigverif.exe launching executables from non-standard paths +Resources: + - Link: https://twitter.com/0gtweet/status/1457676633809330184 + - Link: https://www.hexacorn.com/blog/2018/04/27/i-shot-the-sigverif-exe-the-gui-based-lolbin/ +Acknowledgement: + - Person: Grzegorz Tworek + Handle: '@0gtweet' + - Person: Adam + Handle: '@Hexacorn'