Fox Tempest MSaaS Takedown: Detecting Abuse of Microsoft Artifact Signing

---
title: Potential MSaaS Abuse - Microsoft Signed Binary in User Directory
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects the execution of binaries signed by Microsoft originating from user-writable directories (AppData, Downloads, Temp), a common tactic for MSaaS-delivered malware.
references:
  - https://thehackernews.com/2026/05/microsoft-takes-down-malware-signing.html
author: Security Arsenal
date: 2026/05/13
tags:
  - attack.defense_evasion
  - attack.t1553.002
  - attack.signed_binary_proxy
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Signed: 'true'
    Signer|contains:
      - 'Microsoft Corporation'
      - 'Microsoft Windows'
    Image|contains:
      - '\AppData\'
      - '\Downloads\'
      - '\Temp\'
      - '\Desktop\'
  filter:
    # Filter out known false positives like VS Code, Office updates running from cache if necessary
    Image|contains:
      - '\Microsoft\VSCode\'
      - '\WindowsApps\'
condition: selection and not filter
falsepositives:
  - Legitimate developer tools running from user profiles (e.g., portable apps)
level: high
---
title: Abuse of Signing Tools - Signtool or Azure Artifacts Signing
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the usage of Microsoft signing tools (signtool.exe) or Azure Artifacts signing scripts by non-build accounts or at odd hours, indicating potential MSaaS enrollment activity.
references:
  - https://thehackernews.com/2026/05/microsoft-takes-down-malware-signing.html
author: Security Arsenal
date: 2026/05/13
tags:
  - attack.resource_development
  - attack.t1608.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
      - '\signtool.exe'
      - '\AzureSignTool.exe'
  selection_cli:
    CommandLine|contains:
      - 'sign'
      - '/f '
      - '/p '
  filter_legit:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
    # Add your build service accounts here
    # User|contains:
    #   - 'builduser'
    #   - 'devops'
condition: selection_tools and selection_cli and not filter_legit
falsepositives:
  - Legitimate software developers signing code manually
level: medium

// Hunt for Microsoft-signed binaries executing from user directories
DeviceProcessEvents
| where Timestamp > ago(7d)
| extend FilePath = tolower(FolderPath)
| where FilePath matches regex @".*\\(appdata|downloads|temp|desktop)\\.*" 
| where isnotempty(Signer)
| where Signer contains "Microsoft" 
// Exclude standard windows apps running from WindowsApps in AppData context if applicable
| where not (FolderPath contains "WindowsApps" and ProcessVersionInfoCompanyName contains "Microsoft")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, FolderPath, Signer, SHA256
| order by Timestamp desc

-- Hunt for signed executables in user profile directories
SELECT 
  FullPath,
  Size,
  Mtime,
  Subject,
  Issuer,
  Status
FROM glob(globs="/*/*/Users/*/*.exe")
WHERE 
  -- Check if the file has a valid authenticode signature
  authenticode(filename=FullPath).Status = "Valid"
  -- Exclude signed binaries in standard system paths if they accidentally match the glob
  AND FullPath NOT =~ "C:\\Windows\\"
  AND FullPath NOT =~ "C:\\Program Files\\"
  AND FullPath NOT =~ "C:\\Program Files (x86)\\"

# Audit Script: Detect Suspicious Signed Binaries in User Directories
# Requires Administrator privileges

$UserProfiles = Get-ChildItem "C:\Users" -Directory
$SuspiciousPaths = @("Downloads", "AppData", "Desktop", "Temp", "Documents")
$Findings = @()

foreach ($Profile in $UserProfiles) {
    foreach ($PathType in $SuspiciousPaths) {
        $TargetPath = Join-Path $Profile.FullName $PathType
        if (Test-Path $TargetPath) {
            Write-Host "Scanning $TargetPath..." -ForegroundColor Cyan
            Get-ChildItem -Path $TargetPath -Recurse -Include *.exe,*.dll,*.ps1 -ErrorAction SilentlyContinue | ForEach-Object {
                $Sig = Get-AuthenticodeSignature $_.FullName
                if ($Sig.Status -eq 'Valid') {
                    # Check for Microsoft signing but unusual location
                    if ($Sig.SignerCertificate.Subject -like "*Microsoft*" -or $Sig.SignerCertificate.Issuer -like "*Microsoft*") {
                        $Findings += [PSCustomObject]@{
                            Path       = $_.FullName
                            Signer     = $Sig.SignerCertificate.Subject
                            Status     = $Sig.Status
                            Reason     = $Sig.StatusMessage
                        }
                    }
                }
            }
        }
    }
}

if ($Findings.Count -gt 0) {
    Write-Host "ALERT: Found signed binaries in suspicious locations:" -ForegroundColor Red
    $Findings | Format-Table -AutoSize
} else {
    Write-Host "No suspicious signed binaries found in user directories." -ForegroundColor Green
}