detection.wiki

Defender-DeviceFileCertificateInfo

any: File signing certificate information

#

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

Table
DeviceFileCertificateInfo

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

NameRulesVendors
IsTrusted1 detection ruleKusto

Representative record #

{
  "CertificateCountersignatureTime": "2025-10-09T02:28:49.556Z",
  "CertificateCreationTime": "2025-06-19T18:11:43Z",
  "CertificateExpirationTime": "2026-06-17T18:11:43Z",
  "CertificateSerialNumber": "3300000518418419adcbad294f000000000518",
  "CrlDistributionPointUrls": [
    "http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%20"
  ],
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "IsRootSignerMicrosoft": 1,
  "IsRootSignerMicrosoft@odata.type": "#SByte",
  "IsSigned": 1,
  "IsSigned@odata.type": "#SByte",
  "IsTrusted": 1,
  "IsTrusted@odata.type": "#SByte",
  "Issuer": "Microsoft Windows Production PCA 2011",
  "IssuerHash": "580a6f4cc4e4b669b9ebdc1b2b3e087b80d0678d",
  "ReportId": 6211,
  "ReportId@odata.type": "#Int64",
  "SHA1": "88fcbd42f8e56c5518e4e2c0c97380c51298f575",
  "SignatureType": "Catalog",
  "Signer": "Microsoft Windows",
  "SignerHash": "facde3d80e99afcc15e08ac5a69bd22785287f79",
  "Timestamp": "2026-08-01T01:20:13.3965486Z"
}

Detection Patterns #

Common Indicators #

Positive field/value combinations most frequently checked by detection rules attached to this catalog entry, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

FieldKindValueRulesVendors
ActionType (kusto rule field)eqDriverLoad1 rulekusto

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Kusto #

References #