Sigverif.exe

Commands

1. ExecuteUser T1218

   Execute arbitrary programs through a trusted Microsoft-signed binary to bypass application whitelisting.

   sigverif.exe

   Launch sigverif.exe GUI, click ‘Advanced’, specify arbitrary executable path as ’log file name’, then click ‘View Log’ to execute the binary.

   os: Windows vista, Windows 7, Windows 8, Windows 10, Windows 11

   Execute: EXEApplication: GUI

Detection

• IOCsigverif.exe spawning unexpected child processes

Resources

• https://twitter.com/0gtweet/status/1457676633809330184
• https://www.hexacorn.com/blog/2018/04/27/i-shot-the-sigverif-exe-the-gui-based-lolbin/