Fox Tempest MSaaS: Defending Against Malicious Code Signing Abuse

---
title: Fox Tempest MSaaS - Signed Binary Executing from User Profile
id: 8d4e2a1f-9c5b-4b7d-8e3f-1a2b3c4d5e6f
status: experimental
description: Detects the execution of a validly signed binary from a user-writable directory (AppData, Downloads, Public), a common indicator of MSaaS abuse or signed malware delivery.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/05/19/exposing-fox-tempest-a-malware-signing-service-operation/
author: Security Arsenal
date: 2026/05/20
tags:
  - attack.defense_evasion
  - attack.signed_binary_proxy
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    SignatureStatus: 'Valid'
    Image|contains:
      - '\AppData\'
      - '\Downloads\'
      - '\Public\'
      - '\Desktop\'
  filter_legit:
    Image|contains:
      - '\Teams\'
      - '\Microsoft\Edge\'
      - '\Google\Chrome\'
      - '\Mozilla\Firefox\'
      - '\Zoom\'
      - '\Slack\'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate software installers or updates launched from user downloads (rare for enterprise managed endpoints)
level: high
---
title: Suspicious Code Signing Activity on Endpoint
id: 9f5e3b2a-0d6c-4e8a-9f1a-2b3c4d5e6f7a
status: experimental
description: Detects the usage of code signing tools (signtool.exe) on non-developer workstations. Fox Tempest signs the malware before delivery, but internal compromise to sign tools is also a risk.
references:
  - https://attack.mitre.org/techniques/T1116/
author: Security Arsenal
date: 2026/05/20
tags:
  - attack.defense_evasion
  - attack.t1116
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\signtool.exe'
      - '\certutil.exe'
    CommandLine|contains:
      - 'sign'
      - '-p'
  filter_developer:
    Image|contains:
      - '\Windows Kits\'
      - '\Microsoft SDKs\'
      - '\Program Files (x86)\Windows Kits\'
  condition: selection and not filter_developer
falsepositives:
  - Administrators signing scripts on management servers (rare)
level: medium

DeviceProcessEvents
| where Timestamp > ago(7d)
| where isnotempty(Signer)
| where FolderPath startswith @"C:\Users\" and (FolderPath contains @"\AppData\" or FolderPath contains @"\Downloads\")
// Filter out common browsers and known safe signed apps in user directories
| where FileName !in ~("chrome.exe", "msedge.exe", "firefox.exe", "teams.exe", "zoom.exe", "slack.exe", "outlook.exe")
| extend SignerStatus = iff(IsSigned == true, "Signed", "Unsigned")
| where SignerStatus == "Signed"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, SHA256, Signer, ProcessCommandLine
| sort by Timestamp desc

-- Hunt for signed binaries in user-writable directories
SELECT FullPath, Size, Mtime, 
       parse_string(data=Name, regex='.*\.(exe|dll|sys)') as Extension,
       hash(path=FullPath) as Hash
FROM glob(globs="/*/*/Users/*/AppData/**/*.{exe,dll}", 
          nosymlink=TRUE)
WHERE signature(filename=FullPath).Status = "VALID"
  // Optional: Exclude specific common benign paths if noisy
  AND FullPath NOT =~ "Microsoft"
  AND FullPath NOT =~ "Google"
  AND FullPath NOT =~ "Mozilla"

<#
.SYNOPSIS
    Audit Script: Detects suspicious signed executables in user profiles.
.DESCRIPTION
    Scans user directories for signed executables and exports findings for IR review.
#>

$SuspiciousPaths = @(
    "$env:SystemDrive\Users\*\Downloads\*.exe",
    "$env:SystemDrive\Users\*\AppData\Local\Temp\*.exe",
    "$env:SystemDrive\Users\*\Desktop\*.exe",
    "$env:SystemDrive\Users\*\AppData\Roaming\*.exe"
)

$Report = @()

foreach ($Path in $SuspiciousPaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $File = $_
            try {
                $Sig = Get-AuthenticodeSignature -FilePath $File.FullName
                if ($Sig.Status -eq 'Valid') {
                    # Filter out very common trusted publishers to reduce noise, or remove for full audit
                    if ($Sig.SignerCertificate.Subject -notmatch "Microsoft" -and 
                        $Sig.SignerCertificate.Subject -notmatch "Google" -and
                        $Sig.SignerCertificate.Subject -notmatch "Oracle") {
                        
                        $Report += [PSCustomObject]@{
                            Path         = $File.FullName
                            Signer       = $Sig.SignerCertificate.Subject
                            Issuer       = $Sig.SignerCertificate.Issuer
                            Status       = $Sig.Status
                            TimeStamp    = $File.LastWriteTime
                            SizeMB       = [math]::Round($File.Length / 1MB, 2)
                        }
                    }
                }
            }
            catch {
                # Ignore access errors
            }
        }
    }
}

if ($Report.Count -gt 0) {
    $Report | Format-Table -AutoSize
    $Report | Export-Csv -Path "C:\Temp\FoxTempest_SignedAudit.csv" -NoTypeInformation
    Write-Host "[+] Audit complete. Report saved to C:\Temp\FoxTempest_SignedAudit.csv" -ForegroundColor Cyan
} else {
    Write-Host "[+] No suspicious signed executables found in user directories." -ForegroundColor Green
}