DeviceFileCertificateInfo

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Certificate information of signed files obtained from certificate verification events on endpoints

Attribute	Value
Category	MDE
Basic Logs Eligible	✓ Yes (source)
Supports Transformations	✓ Yes (source)
Ingestion API Supported	✗ No
Azure Monitor Tables Reference	View Documentation
Defender XDR Advanced Hunting Schema	View Documentation

Schema
Solutions
Connectors
Content Items

Schema (24 columns)

Source: Azure Monitor documentation

Column Name	Type	Description
_BilledSize	real	The record size in bytes
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
CertificateCountersignatureTime	datetime	Date and time (UTC) the certificate was countersigned.
CertificateCreationTime	datetime	Date and time (UTC) the certificate was created.
CertificateExpirationTime	datetime	Certificate expiry date and time (UTC).
CertificateSerialNumber	string	Identifier for the certificate that is unique to the issuing certificate authority (CA).
CrlDistributionPointUrls	string	A list of network shares URLs that contains certificates and certificate revocation (CRLs).
DeviceId	string	Unique identifier for the device in the service.
DeviceName	string	Fully qualified domain name (FQDN) of the device.
IsRootSignerMicrosoft	bool	Indicates whether the signer of the root certificate is Microsoft.
IsSigned	bool	Indicates whether the file is signed.
Issuer	string	Information about the issuing certificate authority (CA).
IssuerHash	string	Unique hash value identifying issuing certificate authority (CA).
IsTrusted	bool	Indicates whether the file is trusted based on the results of the WinVerifyTrust function, which checks for unknown root certificate information, invalid signatures, revoked certificates, and other questionable attributes.
MachineGroup	string	Machine group of the machine. This group is used by role-based access control to determine access to the machine.
ReportId	long	Unique identifier for the event.
SHA1	string	SHA-1 hash of the file that the recorded action was applied to.
SignatureType	string	Indicates whether signature information was read as embedded content in the file itself or read from an external catalog file.
Signer	string	Information about the signer of the file.
SignerHash	string	Unique hash value identifying the signer.
SourceSystem	string	The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
TenantId	string	The Log Analytics workspace ID
TimeGenerated	datetime	Date and time the event was recorded by the MDE agent on the endpoint.
Type	string	The name of the table

Solutions (1)

This table is used by the following solutions:

Microsoft Defender XDR

Connectors (1)

This table is ingested by the following connectors:

Connector	Selection Criteria
Microsoft Defender XDR

Content Items Using This Table (57)

Hunting Queries (54)

GitHub Only:

Hunting Query	Selection Criteria
Remote Management and Monitoring tool - AeroAdmin - File Signature
Remote Management and Monitoring tool - Ammyy - File Signature
Remote Management and Monitoring tool - AnyDesk - File Signature
Remote Management and Monitoring tool - AnyViewer - File Signature
Remote Management and Monitoring tool - Atera - File Signature
Remote Management and Monitoring tool - AweSun - File Signature
Remote Management and Monitoring tool - BarracudaRMM - File Signature
Remote Management and Monitoring tool - BeyondTrust - File Signature
Remote Management and Monitoring tool - ConnectWise - File Signature
Remote Management and Monitoring tool - DWService - File Signature
Remote Management and Monitoring tool - DameWare - File Signature
Remote Management and Monitoring tool - DattoRMM - File Signature
Remote Management and Monitoring tool - DesktopNow - File Signature
Remote Management and Monitoring tool - DistantDesktop - File Signature
Remote Management and Monitoring tool - FleetDeck - File Signature
Remote Management and Monitoring tool - GetScreen - File Signature
Remote Management and Monitoring tool - ISLOnline - File Signature
Remote Management and Monitoring tool - IperiusRemote - File Signature
Remote Management and Monitoring tool - Kaseya - File Signature
Remote Management and Monitoring tool - Level - File Signature
Remote Management and Monitoring tool - LiteManager - File Signature
Remote Management and Monitoring tool - LogMeIn - File Signature
Remote Management and Monitoring tool - MSP360_CloudBerry - File Signature
Remote Management and Monitoring tool - MeshCentral - File Signature
Remote Management and Monitoring tool - NAble - File Signature
Remote Management and Monitoring tool - Naverisk - File Signature
Remote Management and Monitoring tool - NetSupport - File Signature
Remote Management and Monitoring tool - NinjaRMM - File Signature
Remote Management and Monitoring tool - OptiTune - File Signature
Remote Management and Monitoring tool - PDQ - File Signature
Remote Management and Monitoring tool - Panorama9 - File Signature
Remote Management and Monitoring tool - PcVisit - File Signature
Remote Management and Monitoring tool - Pulseway - File Signature
Remote Management and Monitoring tool - RealVNC - File Signature
Remote Management and Monitoring tool - RemotePC - File Signature
Remote Management and Monitoring tool - RemoteUtilities - File Signature
Remote Management and Monitoring tool - ScreenMeet - File Signature
Remote Management and Monitoring tool - ServerEye - File Signature
Remote Management and Monitoring tool - ShowMyPC - File Signature
Remote Management and Monitoring tool - SimpleHelp - File Signature
Remote Management and Monitoring tool - Splashtop - File Signature
Remote Management and Monitoring tool - SupRemo - File Signature
Remote Management and Monitoring tool - SyncroMSP - File Signature
Remote Management and Monitoring tool - TacticalRMM - File Signature
Remote Management and Monitoring tool - TeamViewer - File Signature
Remote Management and Monitoring tool - TightVNC - File Signature
Remote Management and Monitoring tool - UltraViewer - File Signature
Remote Management and Monitoring tool - XMReality - File Signature
Remote Management and Monitoring tool - ZohoAssist - File Signature
Remote Management and Monitoring tool - parsec.app - File Signature
Remote Management and Montioring tool - Action1 - File Signature
compromised NVIDIA certificates[Lapsus$]
compromised-certificate[Nobelium]
locate-files-possibly-signed-by-fraudulent-ecc-certificates

Workbooks (3)

In solution Microsoft Defender XDR:

Workbook	Selection Criteria
MicrosoftDefenderForEndPoint