PE signature validation doesn't detect malware signed with sigthief #1071
Description
PE signature validation doesn't detect malware signed with Sigthief.
YARA Rule:
import "pe"
rule fea_pe_improperly_signed {
condition:
uint16(0) == 0x5A4D and pe.number_of_signatures > 0
and not for all i in (0..pe.number_of_signatures - 1):
(
pe.signatures[i].valid_on(pe.timestamp)
)
}
How to reproduce:
1 - Sign Mimikatz using Sigthief
2 - Run the rule provided above against the binary
Expected Results:
YARA reports the binary to be improperly signed.
Current Results:
YARA reports the signature as valid. Probably because the timestamp is valid.
Risk:
It's very likely that dozens of security professionals are using the valid_on() function to try and validate whether a PE is properly signed or not.
Recommendations:
We recommend that the documentation should specify any of the limitations for valid_on(). Also, if YARA could have a way to formally validate whether a binary is properly signed or not, that would be very handy.