GoldenEyeDog Code-Signing Abuse: Detecting Stolen Certificates from DigiCert Breach

---
title: GoldenEyeDog - Signed Binary in Suspicious User Directory
id: 8a4b2c10-9d3e-4f5a-8b1c-2d3e4f5a6b7c
status: experimental
description: Detects validly signed binaries (specifically from major CAs) executing from user-writable directories. This is a common TTP when actors use stolen certs to drop malware in AppData or Temp.
references:
  - https://thehackernews.com/2026/07/goldeneyedog-subgroup-linked-to.html
author: Security Arsenal
date: 2026/07/14
tags:
  - attack.defense_evasion
  - attack.t1059.001
  - attack.s0189
logsource:
  category: process_creation
  product: windows
detection:
  selection_sig:
    SignatureStatus: 'Valid'
    Signer|contains:
      - 'DigiCert'
      - 'Symantec'
  selection_path:
    Image|contains:
      - '\\AppData\'
      - '\\Temp\'
      - '\\Downloads\'
  filter_legit:
    Image|contains:
      - '\\Program Files\'
      - '\\Program Files (x86)\'
      - '\\Windows\\System32\'
  condition: selection_sig and selection_path and not filter_legit
falsepositives:
  - Legitimate software updates installing to temp directories
  - Developer tools running from user profiles
level: high
---
title: GoldenEyeDog - Signed Binary Spawning Windows Script Host
id: 1a2b3c4d-5e6f-7g8h-9i0j-1k2l3m4n5o6p
status: experimental
description: Detects a validly signed process spawning powershell.exe, wscript.exe, or cscript.exe. Malware signed with stolen certs often relies on \"Living Off The Land\" binaries after initial execution.
references:
  - https://thehackernews.com/2026/07/goldeneyedog-subgroup-linked-to.html
author: Security Arsenal
date: 2026/07/14
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1064
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentSignatureStatus: 'Valid'
    ParentSigner|contains:
      - 'DigiCert'  # Adjust if specific compromised CA is known
  selection_child:
    Image|endswith:
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\wscript.exe'
      - '\\cscript.exe'
      - '\\cmd.exe'
  condition: selection_parent and selection_child
falsepositives:
  - System administrators running scripts from signed management tools
  - Installers triggering post-deployment scripts
level: medium
---
title: GoldenEyeDog - Network Connection from Signed Binary to Non-Standard Port
id: 9f8e7d6c-5b4a-3f2e-1d0c-9b8a7f6e5d4c
status: experimental
description: Detects network connections initiated by a validly signed binary to high-numbered ports or non-standard ports, indicative of C2 beaconing from signed malware.
references:
  - https://thehackernews.com/2026/07/goldeneyedog-subgroup-linked-to.html
author: Security Arsenal
date: 2026/07/14
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    SignatureStatus: 'Valid'
    Signer|contains:
      - 'DigiCert'
  filter_standard_ports:
    DestinationPort:
      - 80
      - 443
      - 22
      - 53
  condition: selection and not filter_standard_ports
falsepositives:
  - Legitimate software updates using CDNs on random ports
  - P2P applications
level: low

DeviceProcessEvents
| where Timestamp > ago(7d)
| where isnotempty(SignatureStatus) and SignatureStatus =~ \"Valid\"
| where Signer contains \"DigiCert\" 
| where FolderPath !contains @\"\\Program Files\" 
  and FolderPath !contains @\"\\Windows\\System32\" 
  and FolderPath !contains @\"\\Windows\\SysWOW64\"
| where FolderPath contains @\"\\AppData\" 
   or FolderPath contains @\"\\Temp\" 
   or FolderPath contains @\"\\Downloads\"
| project Timestamp, DeviceName, FileName, FolderPath, Signer, SHA256, AccountName, InitiatingProcessFileName
| order by Timestamp desc

-- Hunt for GoldenEyeDog signed binaries in user directories
SELECT 
  FullPath,
  Size,
  ModTime,
  authenticode(FullPath).IssuerName AS Issuer,
  authenticode(FullPath).SubjectName AS Subject,
  authenticode(FullPath).SignatureState AS SigState
FROM glob(globs=\"C:\\Users\\*\\*.exe\")
WHERE SigState = \"Valid\"
  AND Issuer =~ \"DigiCert\"
  -- Exclude known legitimate paths to reduce noise
  AND not FullPath =~ \"AppData\\\Local\\\Programs\"
  AND not FullPath =~ \"AppData\\\Roaming\\\.*\\update\"

<#
.SYNOPSIS
    Hunt for GoldenEyeDog signed binaries in suspicious locations.
.DESCRIPTION
    Scans for validly signed executables matching the DigiCert issuer
    outside of standard Windows/Program Files paths.
#>

$LogPath = \"$env:USERPROFILE\\Desktop\\GoldenEyeDog_Hunt.log\"
$IssuerMatch = \"DigiCert\"
$SafePaths = @(
    \"$env:SystemRoot\\System32\",
    \"$env:SystemRoot\\SysWOW64\",
    \"$env:ProgramFiles\",
    \"$env:ProgramFiles(x86)\"
)

Write-Host \"[+] Initiating Hunt for Stolen Certificate Abuse...\" -ForegroundColor Cyan

Get-ChildItem -Path C:\ -Filter *.exe -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
    $FilePath = $_.FullName
    
    # Skip protected paths to improve performance
    if ($SafePaths | Where-Object { $FilePath -like \"$_*\" }) { return }

    try {
        $Sig = Get-AuthenticodeSignature -FilePath $FilePath
        
        if ($Sig.Status -eq 'Valid' -and $Sig.SignerCertificate.Issuer -like \"*$IssuerMatch*\") {
            $AlertMsg = \"[!] Suspicious Signed Binary: $FilePath | Subject: $($Sig.SignerCertificate.Subject)\"
            Write-Host $AlertMsg -ForegroundColor Red
            Add-Content -Path $LogPath -Value $AlertMsg
        }
    }
    catch {
        # Ignore access errors
    }
}

Write-Host \"[+] Hunt Complete. Review logs at $LogPath\" -ForegroundColor Green