Defender-DeviceFileCertificateInfo
| ActionType | Title | Sample | Rule |
|---|---|---|---|
| any | File signing certificate information | Y | Y |
any: File signing certificate information
#Fields #
| Name | Description |
|---|---|
Timestamp | |
DeviceId | |
DeviceName | |
SHA1 | |
IsSigned | |
SignatureType | |
Signer | |
SignerHash | |
Issuer | |
IssuerHash | |
CertificateSerialNumber | |
CrlDistributionPointUrls | |
CertificateCreationTime | |
CertificateExpirationTime | |
CertificateCountersignatureTime | |
IsTrusted | |
IsRootSignerMicrosoft | |
ReportId |
Example Event #
{
"CertificateCountersignatureTime": "2025-10-09T02:28:49.556Z",
"CertificateCreationTime": "2025-06-19T18:11:43Z",
"CertificateExpirationTime": "2026-06-17T18:11:43Z",
"CertificateSerialNumber": "3300000518418419adcbad294f000000000518",
"CrlDistributionPointUrls": [
"http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%20"
],
"DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
"DeviceName": "jd-win11-22h2-1.ludus.domain",
"IsRootSignerMicrosoft": 1,
"IsRootSignerMicrosoft@odata.type": "#SByte",
"IsSigned": 1,
"IsSigned@odata.type": "#SByte",
"IsTrusted": 1,
"IsTrusted@odata.type": "#SByte",
"Issuer": "Microsoft Windows Production PCA 2011",
"IssuerHash": "580a6f4cc4e4b669b9ebdc1b2b3e087b80d0678d",
"ReportId": 6211,
"ReportId@odata.type": "#Int64",
"SHA1": "88fcbd42f8e56c5518e4e2c0c97380c51298f575",
"SignatureType": "Catalog",
"Signer": "Microsoft Windows",
"SignerHash": "facde3d80e99afcc15e08ac5a69bd22785287f79",
"Timestamp": "2026-08-01T01:20:13.3965486Z"
}
Detection Patterns #
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
ActionType (kusto rule field) | eq | DriverLoad | 1 rule | kusto |
GlobalPrevalence (kusto rule field) | is_null | | 1 rule | kusto |
GlobalPrevalence (kusto rule field) | lt | 200 | 1 rule | kusto |
dcount_DeviceId (kusto rule field) | le | 5 | 1 rule | kusto |
diff (kusto rule field) | ne | [] | 1 rule | kusto |
parent_process_name (kusto rule field) | is_not_null | | 1 rule | kusto |
sha1 (kusto rule field) | is_not_null | | 1 rule | kusto |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Kusto #
Block executable files from running unless they meet a prevalence, age, or trusted list criterion
You may need to exclude software development users/machines/folders.