数字签名与信任链取证深度分析

sigcheck.exe -v -vt -e "C:\Windows\System32\drivers"

Get-ChildItem -Path Cert:\LocalMachine\My -CodeSigningCert | 
    Format-List Subject, Thumbprint, NotAfter, HasPrivateKey, Issuer

security find-identity -v -p codesigning /Library/Keychains/System.keychain

certutil -urlfetch -verify "C:\temp\suspicious_cert.der"

python sigthief.py -i legitimate_signed.exe -t unsigned_malware.exe -o fake_signed_malware.exe

Get-WindowsDriver -Online | Where-Object {$_.ClassName -eq "kernel"} | 
    Select-Object Driver, Version, Date, ProviderName | 
    Sort-Object Date -Descending | Format-Table -AutoSize

echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -fingerprint -sha256

openssl ocsp -issuer issuer.pem -cert target.pem -url http://ocsp.example.com -resp_text

Certify.exe /ca:CA-SERVER\CA-NAME /template:VulnerableTemplate /altname:administrator

#!/bin/bash
CA_LOG="/var/log/certsrv/IssuedCerts.log"
SUSPICIOUS_PATTERNS="sandbox\.|test\.|internal\.|staging\.|dev\."
ALERT_EMAIL="security-team@company.com"

if [ ! -f "$CA_LOG" ]; then
    echo "CA log file not found: $CA_LOG"
    exit 1
fi

grep -i "issued" "$CA_LOG" | while IFS=',' read -r date time serial template requester san; do
    for pattern in $SUSPICIOUS_PATTERNS; do
        if echo "$san" | grep -qi "$pattern"; then
            echo "[ALERT] Suspicious cert issued: SAN=$san Requester=$requester Template=$template Serial=$serial"
        fi
    done
done

curl -s "https://crt.sh/?q=%.example.com&output=json" | python3 -m json.tool | \
    jq '[.[] | {id, issuer_name, name_value, not_before, not_after, serial_number}]' | \
    sort_by(.not_before)

SELECT ci.NAME_VALUE, ci.ISSUER_NAME, c.NOT_BEFORE, c.NOT_AFTER, c.SERIAL_NUMBER
FROM certificate_issuer ci
JOIN certificates c ON ci.ID = c.ID
WHERE ci.NAME_VALUE LIKE '%.example.com'
AND c.NOT_BEFORE > '2024-01-01'
ORDER BY c.NOT_BEFORE DESC;

import requests
import json
import sys
from datetime import datetime

def query_ct_log(domain):
    url = f"https://crt.sh/?q=%.{domain}&output=json"
    try:
        response = requests.get(url, timeout=30)
        response.raise_for_status()
        return json.loads(response.text)
    except requests.exceptions.RequestException as e:
        print(f"Error querying CT log: {e}")
        return []

def analyze_certificates(certs, known_cas=None):
    if known_cas is None:
        known_cas = []

    findings = []
    for cert in certs:
        issuer = cert.get("issuer_name", "")
        name_value = cert.get("name_value", "")
        not_before = cert.get("not_before", "")
        serial = cert.get("serial_number", "")

        is_unauthorized = False
        reason = ""

        if known_cas and issuer not in known_cas:
            is_unauthorized = True
            reason = f"Unknown CA: {issuer}"

        entry = {
            "domain": name_value,
            "issuer": issuer,
            "not_before": not_before,
            "serial": serial,
            "suspicious": is_unauthorized,
            "reason": reason
        }
        findings.append(entry)

    return findings

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <domain> [known_ca1 known_ca2 ...]")
        sys.exit(1)

    target_domain = sys.argv[1]
    known_cas = sys.argv[2:] if len(sys.argv) > 2 else []

    print(f"[*] Querying CT logs for: *.{target_domain}")
    certs = query_ct_log(target_domain)
    print(f"[*] Found {len(certs)} certificates")

    findings = analyze_certificates(certs, known_cas)

    suspicious = [f for f in findings if f["suspicious"]]
    if suspicious:
        print(f"\n[!] {len(suspicious)} potentially unauthorized certificates found:")
        for f in suspicious:
            print(f"  Domain: {f['domain']}")
            print(f"  Issuer: {f['issuer']}")
            print(f"  Date: {f['not_before']}")
            print(f"  Reason: {f['reason']}")
            print()
    else:
        print("[*] No unauthorized certificates detected")

title: Suspicious Root CA Certificate Installation
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: stable
description: Detects installation of new root CA certificates, which may indicate MITM attack preparation
references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4886
author: Security Team
date: 2026/07/06
tags:
  - attack.credential_access
  - attack.t1553.004
logsource:
  product: windows
  service: security
detection:
  selection_event_id:
    EventID:
      - 4886
      - 4887
  selection_target_store:
    TargetStore|contains:
      - 'Root'
      - 'Trusted'
  condition: selection_event_id and selection_target_store
  level: high

curl -s "https://crt.sh/?q=%.target-company.com&output=json" | \
    python3 -c "
import sys, json
from collections import Counter
data = json.load(sys.stdin)
issuers = Counter(c.get('issuer_name','Unknown') for c in data)
for issuer, count in issuers.most_common(10):
    print(f'{count:4d} | {issuer}')
"

signtool sign /f cert.pfx /p password /tr http://timestamp.digicert.com /td sha256 application.exe

Get-AuthenticodeSignature "C:\Windows\System32\drivers\suspicious.sys" | 
    Select-Object Status, StatusMessage, SignerCertificate, TimeStamperCertificate | 
    Format-List *

openssl pkcs7 -inform DER -in signed_file.p7b -print_certificates | \
    grep -A2 "Not Before" 

openssl smime -verify -in signed_package.bin -signer ca_cert.pem \
    -CAfile root_ca.pem -out verified_content.bin

npm audit signatures --registry https://registry.npmjs.org/
pip install --require-hashes -r requirements.txt

syft ./target-application -o spdx-json > sbom.spdx.json
grype sbom:sbom.spdx.json --fail-on high

cosign verify --key cosign.pub \
    --certificate-identity=developer@example.com \
    --certificate-oidc-issuer=https://accounts.google.com \
    ghcr.io/example/image:tag

#!/bin/bash
TARGET_DIR="${1:-.}"
OUTPUT_FILE="signature_audit_$(date +%Y%m%d_%H%M%S).csv"
SUSPICIOUS_THRESHOLD=5

echo "File,Status,Certificate_Thumbprint,Issuer,Subject,Expiry" > "$OUTPUT_FILE"

find "$TARGET_DIR" -type f \( -name "*.exe" -o -name "*.dll" -o -name "*.sys" \) 2>/dev/null | while read -r file; do
    if command -v osslsigncode &> /dev/null; then
        result=$(osslsigncode verify "$file" 2>&1)
        status=$?
        if [ $status -eq 0 ]; then
            thumbprint=$(echo "$result" | grep -oP 'Thumbprint\([A-F0-9]+\)' | head -1 | tr -dc 'A-F0-9')
            issuer=$(echo "$result" | grep -oP 'Issuer: \K.*' | head -1)
            subject=$(echo "$result" | grep -oP 'Subject: \K.*' | head -1)
            echo "\"$file\",\"VALID\",\"$thumbprint\",\"$issuer\",\"$subject\",\"\"" >> "$OUTPUT_FILE"
        else
            echo "\"$file\",\"INVALID/UNSIGNED\",\"N/A\",\"N/A\",\"N/A\",\"N/A\"" >> "$OUTPUT_FILE"
        fi
    elif command -v sigcheck &> /dev/null; then
        result=$(sigcheck.exe -accepteula -v "$file" 2>/dev/null)
        echo "\"$file\",\"$(echo "$result" | tail -1)\"" >> "$OUTPUT_FILE"
    else
        echo "[ERROR] No signature verification tool available. Install osslsigncode or sigcheck."
        exit 1
    fi
done

total=$(wc -l < "$OUTPUT_FILE")
invalid=$(grep -c '"INVALID' "$OUTPUT_FILE" || true)
unsigned=$(grep -c '"UNSIGNED' "$OUTPUT_FILE" || true)
echo "[*] Scan complete: $total files scanned, $invalid invalid signatures, $unsigned unsigned files"
echo "[*] Results saved to: $OUTPUT_FILE"

import requests
import json
import sys
import hashlib
from datetime import datetime, timedelta
from collections import defaultdict

KNOWN_CAS = [
    "DigiCert Inc", "Let's Encrypt", "Sectigo Limited",
    "Cloudflare Inc", "Google Trust Services LLC",
    "Amazon", "Microsoft Corporation"
]

ALERT_DOMAINS = ["example-corp.com", "internal-company.com"]

def query_crt_sh(domain):
    url = f"https://crt.sh/?q=%.{domain}&output=json"
    try:
        resp = requests.get(url, timeout=30, headers={"User-Agent": "CT-Forensics/1.0"})
        resp.raise_for_status()
        return json.loads(resp.text)
    except Exception as e:
        print(f"[ERROR] Failed to query crt.sh for {domain}: {e}")
        return []

def detect_anomalies(certs, known_cas):
    anomalies = []
    ca_counts = defaultdict(int)
    domain_timeline = []

    for cert in certs:
        issuer = cert.get("issuer_name", "Unknown")
        not_before = cert.get("not_before", "")
        not_after = cert.get("not_after", "")
        name = cert.get("name_value", "")
        serial = cert.get("serial_number", "")

        ca_counts[issuer] += 1

        is_unknown_ca = not any(known in issuer for known in known_cas)
        is_short_lived = False
        if not_before and not_after:
            try:
                start = datetime.strptime(not_before, "%Y-%m-%dT%H:%M:%S")
                end = datetime.strptime(not_after, "%Y-%m-%dT%H:%M:%S")
                lifetime = (end - start).days
                is_short_lived = lifetime < 30
            except ValueError:
                pass

        if is_unknown_ca:
            anomalies.append({
                "type": "UNKNOWN_CA",
                "severity": "HIGH",
                "domain": name,
                "issuer": issuer,
                "not_before": not_before,
                "serial": serial,
                "detail": f"Certificate issued by unknown CA: {issuer}"
            })

        if is_short_lived:
            anomalies.append({
                "type": "SHORT_LIVED_CERT",
                "severity": "MEDIUM",
                "domain": name,
                "issuer": issuer,
                "not_before": not_before,
                "serial": serial,
                "detail": "Certificate valid for less than 30 days"
            })

        domain_timeline.append({
            "domain": name,
            "issuer": issuer,
            "not_before": not_before,
            "serial": serial
        })

    return anomalies, ca_counts, domain_timeline

def main():
    if len(sys.argv) < 2:
        print(f"Usage: python3 {sys.argv[0]} <domain1> [domain2] ...")
        sys.exit(1)

    target_domains = sys.argv[1:]

    for domain in target_domains:
        print(f"\n{'='*60}")
        print(f"[*] Analyzing CT logs for: {domain}")
        print(f"{'='*60}")

        certs = query_crt_sh(domain)
        if not certs:
            print(f"[!] No certificates found for {domain}")
            continue

        anomalies, ca_counts, timeline = detect_anomalies(certs, KNOWN_CAS)

        print(f"[*] Total certificates found: {len(certs)}")
        print(f"[*] Anomalies detected: {len(anomalies)}")

        print(f"\n--- CA Distribution ---")
        for ca, count in sorted(ca_counts.items(), key=lambda x: -x[1]):
            marker = " [UNKNOWN CA]" if not any(k in ca for k in KNOWN_CAS) else ""
            print(f"  {count:4d} | {ca}{marker}")

        if anomalies:
            print(f"\n--- Anomalies ---")
            for a in anomalies:
                print(f"  [{a['severity']}] {a['type']}: {a['detail']}")
                print(f"    Domain: {a['domain']}")
                print(f"    Issuer: {a['issuer']}")
                print(f"    Date: {a['not_before']}")
                print(f"    Serial: {a['serial']}")
                print()
        else:
            print(f"\n[*] No anomalies detected")

if __name__ == "__main__":
    main()

title: New Root CA Certificate Installed
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: stable
description: Detects installation of new root CA certificates in the local trust store
author: Security Team
date: 2026/07/06
modified: 2026/07/06
tags:
  - attack.credential_access
  - attack.t1553.004
  - attack.defense_evasion
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4886
      - 4887
  filter_legitimate:
    SubjectName|contains:
      - 'DigiCert'
      - 'Let''s Encrypt'
      - 'Microsoft'
      - 'Google'
      - 'Amazon'
      - 'Cloudflare'
  condition: selection and not filter_legitimate
  falsepositives:
    - Legitimate PKI infrastructure changes
  level: medium

title: Suspicious Code Signing Certificate Usage
id: c3d4e5f6-a7b8-9012-cdef-234567890123
status: experimental
description: Detects code signing events that may indicate use of stolen or unauthorized certificates
author: Security Team
date: 2026/07/06
tags:
  - attack.defense_evasion
  - attack.t1553.002
  - attack.t1036
logsource:
  product: windows
  service: sysmon
detection:
  selection_sign:
    EventID: 15
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.sys'
  selection_unsigned_or_weak:
    ImageLoaded|contains:
      - '\Temp\'
      - '\AppData\Local\Temp\'
      - '\Downloads\'
  condition: selection_sign and selection_unsigned_or_weak
  level: medium

param(
    [string]$StorePath = "Cert:\LocalMachine\My",
    [string]$OutputCsv = "CodeSigningCertAudit.csv"
)

$certificates = Get-ChildItem -Path $StorePath -CodeSigningCert

$results = @()

foreach ($cert in $certificates) {
    $status = "Valid"
    $revokeReason = ""

    try {
        $chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain
        $chain.Build($cert) | Out-Null

        foreach ($element in $chain.ChainElements) {
            if ($element.ChainElementStatus.Length -gt 0) {
                foreach ($status_info in $element.ChainElementStatus) {
                    if ($status_info.Status -ne "NoError") {
                        $status = "ChainError: $($status_info.Status)"
                        $revokeReason = $status_info.StatusInformation
                    }
                }
            }
        }

        $ocspUrl = ($cert.Extensions | Where-Object { $_.Oid.Value -eq "1.3.6.1.5.5.7.1.1" }).RawData
        if ($ocspUrl) {
            $status += " [OCSP Available]"
        }
    } catch {
        $status = "VerificationFailed: $($_.Exception.Message)"
    }

    $result = [PSCustomObject]@{
        Subject = $cert.Subject
        Issuer = $cert.Issuer
        Thumbprint = $cert.Thumbprint
        NotBefore = $cert.NotBefore
        NotAfter = $cert.NotAfter
        SerialNumber = $cert.SerialNumber
        HasPrivateKey = $cert.HasPrivateKey
        KeyLength = $cert.PublicKey.Key.KeySize
        SignatureAlgorithm = $cert.SignatureAlgorithm.FriendlyName
        Status = $status
        RevokeReason = $revokeReason
        StorePath = $StorePath
    }
    $results += $result
}

$results | Export-Csv -Path $OutputCsv -NoTypeInformation -Encoding UTF8

Write-Host "`n=== Certificate Audit Summary ===" -ForegroundColor Cyan
Write-Host "Total certificates: $($results.Count)"
Write-Host "With private key: $(($results | Where-Object { $_.HasPrivateKey }).Count)"
Write-Host "Expired: $(($results | Where-Object { $_.NotAfter -lt (Get-Date) }).Count)"
Write-Host "Chain errors: $(($results | Where-Object { $_.Status -ne 'Valid' }).Count)"

$results | Where-Object { $_.Status -ne "Valid" } | ForEach-Object {
    Write-Host "[WARNING] $($_.Subject) - Status: $($_.Status)" -ForegroundColor Yellow
}

Get-AuthenticodeSignature "C:\Windows\System32\drivers\RTCore64.sys" | 
    Select-Object Status, SignerCertificate | Format-List *

Get-ChildItem "Cert:\LocalMachine\Disallowed" | 
    Where-Object { $_.Subject -like "*Realtek*" -or $_.Subject -like "*JMicron*" } |
    Select-Object Subject, Thumbprint