DeviceFileCertificateInfo

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Certificate information of signed files obtained from certificate verification events on endpoints

Attribute Value
Category MDE
Basic Logs Eligible ✓ Yes (source)
Supports Transformations ✓ Yes (source)
Ingestion API Supported ✗ No
Lake-Only Ingestion ✓ Yes
Azure Monitor Tables Reference View Documentation
Defender XDR Advanced Hunting Schema View Documentation

Contents

Schema (24 columns)

Source: Azure Monitor documentation

Column Name Type Description
_BilledSize real The record size in bytes
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
CertificateCountersignatureTime datetime Date and time (UTC) the certificate was countersigned.
CertificateCreationTime datetime Date and time (UTC) the certificate was created.
CertificateExpirationTime datetime Certificate expiry date and time (UTC).
CertificateSerialNumber string Identifier for the certificate that is unique to the issuing certificate authority (CA).
CrlDistributionPointUrls string A list of network shares URLs that contains certificates and certificate revocation (CRLs).
DeviceId string Unique identifier for the device in the service.
DeviceName string Fully qualified domain name (FQDN) of the device.
IsRootSignerMicrosoft bool Indicates whether the signer of the root certificate is Microsoft.
IsSigned bool Indicates whether the file is signed.
Issuer string Information about the issuing certificate authority (CA).
IssuerHash string Unique hash value identifying issuing certificate authority (CA).
IsTrusted bool Indicates whether the file is trusted based on the results of the WinVerifyTrust function, which checks for unknown root certificate information, invalid signatures, revoked certificates, and other questionable attributes.
MachineGroup string Machine group of the machine. This group is used by role-based access control to determine access to the machine.
ReportId long Unique identifier for the event.
SHA1 string SHA-1 hash of the file that the recorded action was applied to.
SignatureType string Indicates whether signature information was read as embedded content in the file itself or read from an external catalog file.
Signer string Information about the signer of the file.
SignerHash string Unique hash value identifying the signer.
SourceSystem string The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
TenantId string The Log Analytics workspace ID
TimeGenerated datetime Date and time the event was recorded by the MDE agent on the endpoint.
Type string The name of the table

Schema References

Official Microsoft Learn documentation for field/column information:

Solutions (2)

This table is used by the following solutions:

Connectors (1)

This table is ingested by the following connectors:

Connector Selection Criteria
Microsoft Defender XDR

Content Items Using This Table (61)

Hunting Queries (58)

Standalone Content:

Hunting Query Selection Criteria
First-Time Network Connection by Unusual Process
High volume LSASS memory read
Short-lived ephemeral code signing certificates
Suspicious LSASS access request by non-system account

GitHub Only:

Hunting Query Selection Criteria
Remote Management and Monitoring tool - AeroAdmin - File Signature Signer has "AeroAdmin"
Remote Management and Monitoring tool - Ammyy - File Signature Signer has "Ammyy"
Remote Management and Monitoring tool - AnyDesk - File Signature Signer has_any "anydesk software"
Remote Management and Monitoring tool - AnyViewer - File Signature Signer has "AOMEI International Network Limited"
Remote Management and Monitoring tool - Atera - File Signature Signer has "Atera Networks"
Remote Management and Monitoring tool - AweSun - File Signature Signer has_any "aweray limited"
Remote Management and Monitoring tool - BarracudaRMM - File Signature Signer has "Barracuda Networks"
Remote Management and Monitoring tool - BeyondTrust - File Signature Signer has_any "Bomgar Corporation"
Remote Management and Monitoring tool - ConnectWise - File Signature Signer has_any "ConnectWise"
Remote Management and Monitoring tool - DWService - File Signature Signer has "DWSNET OÜ"
Remote Management and Monitoring tool - DameWare - File Signature Signer has "DameWare Development"
Remote Management and Monitoring tool - DattoRMM - File Signature Signer has "Datto Inc"
Remote Management and Monitoring tool - DesktopNow - File Signature Signer has "NCH Software"
Remote Management and Monitoring tool - DistantDesktop - File Signature Signer has "German Gorodokuplya"
Remote Management and Monitoring tool - FleetDeck - File Signature Signer has "FleetDeck"
Remote Management and Monitoring tool - GetScreen - File Signature Signer has "Point B Ltd"
Remote Management and Monitoring tool - ISLOnline - File Signature Signer has_any "ISL Online"
Remote Management and Monitoring tool - IperiusRemote - File Signature Signer has_any "Enter Srl"
Remote Management and Monitoring tool - Kaseya - File Signature Signer has "Kaseya"
Remote Management and Monitoring tool - Level - File Signature Signer has "Level Software, Inc"
Remote Management and Monitoring tool - LiteManager - File Signature Signer has "Yakhnovets Denis Aleksandrovich IP"
Remote Management and Monitoring tool - LogMeIn - File Signature Signer has_any "LogMeIn"
Remote Management and Monitoring tool - MSP360_CloudBerry - File Signature Signer has_any "MSPBytes"
Remote Management and Monitoring tool - MeshCentral - File Signature Signer has "meshcentral"
Remote Management and Monitoring tool - NAble - File Signature Signer has_any "N-Able Technologies"
Remote Management and Monitoring tool - Naverisk - File Signature Signer has_any "naverisk"
Remote Management and Monitoring tool - NetSupport - File Signature Signer has "netsupport"
Remote Management and Monitoring tool - NinjaRMM - File Signature Signer has "NinjaRMM"
Remote Management and Monitoring tool - OptiTune - File Signature Signer has "Bravura Software LLC"
Remote Management and Monitoring tool - PDQ - File Signature Signer has "PDQ.com"
Remote Management and Monitoring tool - Panorama9 - File Signature Signer has "Panorama9"
Remote Management and Monitoring tool - PcVisit - File Signature Signer has "pcvisit software ag"
Remote Management and Monitoring tool - Pulseway - File Signature Signer has "MMSoft Design"
Remote Management and Monitoring tool - RealVNC - File Signature Signer has "realvnc"
Remote Management and Monitoring tool - RemotePC - File Signature Signer has "idrive"
Remote Management and Monitoring tool - RemoteUtilities - File Signature Signer has "Remote Utilities"
Remote Management and Monitoring tool - ScreenMeet - File Signature Signer has "Projector.is, Inc."
Remote Management and Monitoring tool - ServerEye - File Signature Signer has "Krämer IT Solutions GmbH"
Remote Management and Monitoring tool - ShowMyPC - File Signature Signer has "ShowMyPC"
Remote Management and Monitoring tool - SimpleHelp - File Signature Signer has "SimpleHelp Ltd"
Remote Management and Monitoring tool - Splashtop - File Signature Signer has "Splashtop"
Remote Management and Monitoring tool - SupRemo - File Signature Signer has "Nanosystems S.R.L."
Remote Management and Monitoring tool - SyncroMSP - File Signature Signer has "Servably, Inc."
Remote Management and Monitoring tool - TacticalRMM - File Signature Signer has_any "AmidaWare"
Remote Management and Monitoring tool - TeamViewer - File Signature Signer has "TeamViewer"
Remote Management and Monitoring tool - TightVNC - File Signature Signer has "glavsoft"
Remote Management and Monitoring tool - UltraViewer - File Signature Signer has "Duc Fabulous"
Remote Management and Monitoring tool - XMReality - File Signature Signer has "XMReality"
Remote Management and Monitoring tool - ZohoAssist - File Signature Signer has "Zoho"
Remote Management and Monitoring tool - parsec.app - File Signature Signer has "Parsec Cloud"
Remote Management and Montioring tool - Action1 - File Signature Signer has "Action1 Corporation"
compromised NVIDIA certificates[Lapsus$] CertificateSerialNumber in "14781bc862e8dc503a559346f5dcc518,43BB437D609866286DD839E1D00309F5"
compromised-certificate[Nobelium] Signer == "Solarwinds Worldwide, LLC"
SignerHash == "47d92d49e6f7f296260da1af355f941eb25360c4"
locate-files-possibly-signed-by-fraudulent-ecc-certificates IsRootSignerMicrosoft == "1"
IsSigned == "1"
IsTrusted == "1"
Issuer !startswith "Microsoft"
Issuer !startswith "Windows"
SignatureType == "Embedded"

Workbooks (3)

In solution Microsoft Defender XDR:

Workbook Selection Criteria
MicrosoftDefenderForEndPoint

GitHub Only:

Workbook Selection Criteria
MicrosoftDefenderForEndPoint
MicrosoftSentinelDeploymentandMigrationTracker

Selection Criteria Summary (54 criteria, 54 total references)

References by type: 0 connectors, 54 content items, 0 ASIM parsers, 0 other parsers.

Selection Criteria Connectors Content Items ASIM Parsers Other Parsers Total
CertificateSerialNumber in "14781bc862e8dc503a559346f5dcc518,43BB437D609866286DD839E1D00309F5" - 1 - - 1
Signer == "Solarwinds Worldwide, LLC"
SignerHash == "47d92d49e6f7f296260da1af355f941eb25360c4"		 - 1 - - 1
IsRootSignerMicrosoft == "1"
IsSigned == "1"
IsTrusted == "1"
Issuer !startswith "Microsoft"
Issuer !startswith "Windows"
SignatureType == "Embedded"		 - 1 - - 1
Signer has "Action1 Corporation" - 1 - - 1
Signer has "AeroAdmin" - 1 - - 1
Signer has "Ammyy" - 1 - - 1
Signer has_any "anydesk software" - 1 - - 1
Signer has "AOMEI International Network Limited" - 1 - - 1
Signer has "Atera Networks" - 1 - - 1
Signer has_any "aweray limited" - 1 - - 1
Signer has "Barracuda Networks" - 1 - - 1
Signer has_any "Bomgar Corporation" - 1 - - 1
Signer has_any "ConnectWise" - 1 - - 1
Signer has "DameWare Development" - 1 - - 1
Signer has "Datto Inc" - 1 - - 1
Signer has "NCH Software" - 1 - - 1
Signer has "German Gorodokuplya" - 1 - - 1
Signer has "DWSNET OÜ" - 1 - - 1
Signer has "FleetDeck" - 1 - - 1
Signer has "Point B Ltd" - 1 - - 1
Signer has_any "Enter Srl" - 1 - - 1
Signer has_any "ISL Online" - 1 - - 1
Signer has "Kaseya" - 1 - - 1
Signer has "Level Software, Inc" - 1 - - 1
Signer has "Yakhnovets Denis Aleksandrovich IP" - 1 - - 1
Signer has_any "LogMeIn" - 1 - - 1
Signer has "meshcentral" - 1 - - 1
Signer has_any "MSPBytes" - 1 - - 1
Signer has_any "N-Able Technologies" - 1 - - 1
Signer has_any "naverisk" - 1 - - 1
Signer has "netsupport" - 1 - - 1
Signer has "NinjaRMM" - 1 - - 1
Signer has "Bravura Software LLC" - 1 - - 1
Signer has "Panorama9" - 1 - - 1
Signer has "Parsec Cloud" - 1 - - 1
Signer has "pcvisit software ag" - 1 - - 1
Signer has "PDQ.com" - 1 - - 1
Signer has "MMSoft Design" - 1 - - 1
Signer has "realvnc" - 1 - - 1
Signer has "idrive" - 1 - - 1
Signer has "Remote Utilities" - 1 - - 1
Signer has "Projector.is, Inc." - 1 - - 1
Signer has "Krämer IT Solutions GmbH" - 1 - - 1
Signer has "ShowMyPC" - 1 - - 1
Signer has "SimpleHelp Ltd" - 1 - - 1
Signer has "Splashtop" - 1 - - 1
Signer has "Nanosystems S.R.L." - 1 - - 1
Signer has "Servably, Inc." - 1 - - 1
Signer has_any "AmidaWare" - 1 - - 1
Signer has "TeamViewer" - 1 - - 1
Signer has "glavsoft" - 1 - - 1
Signer has "Duc Fabulous" - 1 - - 1
Signer has "XMReality" - 1 - - 1
Signer has "Zoho" - 1 - - 1
Total 0 54 0 0 54

CertificateSerialNumber

Value Connectors Content Items ASIM Parsers Other Parsers Total
14781bc862e8dc503a559346f5dcc518 - 1 - - 1
43BB437D609866286DD839E1D00309F5 - 1 - - 1

IsRootSignerMicrosoft

Value Connectors Content Items ASIM Parsers Other Parsers Total
1 - 1 - - 1

IsSigned

Value Connectors Content Items ASIM Parsers Other Parsers Total
1 - 1 - - 1

IsTrusted

Value Connectors Content Items ASIM Parsers Other Parsers Total
1 - 1 - - 1

Issuer

Value Connectors Content Items ASIM Parsers Other Parsers Total
!startswith Microsoft - 1 - - 1
!startswith Windows - 1 - - 1

SignatureType

Value Connectors Content Items ASIM Parsers Other Parsers Total
Embedded - 1 - - 1

Signer

Value Connectors Content Items ASIM Parsers Other Parsers Total
Solarwinds Worldwide, LLC - 1 - - 1
has Action1 Corporation - 1 - - 1
has AeroAdmin - 1 - - 1
has Ammyy - 1 - - 1
has_any anydesk software - 1 - - 1
has AOMEI International Network Limited - 1 - - 1
has Atera Networks - 1 - - 1
has_any aweray limited - 1 - - 1
has Barracuda Networks - 1 - - 1
has_any Bomgar Corporation - 1 - - 1
has_any ConnectWise - 1 - - 1
has DameWare Development - 1 - - 1
has Datto Inc - 1 - - 1
has NCH Software - 1 - - 1
has German Gorodokuplya - 1 - - 1
has DWSNET OÜ - 1 - - 1
has FleetDeck - 1 - - 1
has Point B Ltd - 1 - - 1
has_any Enter Srl - 1 - - 1
has_any ISL Online - 1 - - 1
has Kaseya - 1 - - 1
has Level Software, Inc - 1 - - 1
has Yakhnovets Denis Aleksandrovich IP - 1 - - 1
has_any LogMeIn - 1 - - 1
has meshcentral - 1 - - 1
has_any MSPBytes - 1 - - 1
has_any N-Able Technologies - 1 - - 1
has_any naverisk - 1 - - 1
has netsupport - 1 - - 1
has NinjaRMM - 1 - - 1
has Bravura Software LLC - 1 - - 1
has Panorama9 - 1 - - 1
has Parsec Cloud - 1 - - 1
has pcvisit software ag - 1 - - 1
has PDQ.com - 1 - - 1
has MMSoft Design - 1 - - 1
has realvnc - 1 - - 1
has idrive - 1 - - 1
has Remote Utilities - 1 - - 1
has Projector.is, Inc. - 1 - - 1
has Krämer IT Solutions GmbH - 1 - - 1
has ShowMyPC - 1 - - 1
has SimpleHelp Ltd - 1 - - 1
has Splashtop - 1 - - 1
has Nanosystems S.R.L. - 1 - - 1
has Servably, Inc. - 1 - - 1
has_any AmidaWare - 1 - - 1
has TeamViewer - 1 - - 1
has glavsoft - 1 - - 1
has Duc Fabulous - 1 - - 1
has XMReality - 1 - - 1
has Zoho - 1 - - 1

SignerHash

Value Connectors Content Items ASIM Parsers Other Parsers Total
47d92d49e6f7f296260da1af355f941eb25360c4 - 1 - - 1

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index