Rule Info
Name
SUSP_Payload_In_Certificate_Table_Mod_Nov26
Author
Jonathan Peters (cod3nym)
Description
Detects payload hidden in the signature area of a signed binary and loaded by a sideloaded DLL. A technique observed to be used by Chinese threat actors in business email compromise attacks.
Score
70
Date
2026-11-02
Minimum Yara
3.6.0
Rule Hash
e3e7b3a1e3b32d4b03a176e4b65f8c37
Tags
['FILE', 'EXE', 'CHINA', 'SUSP']
Required Modules
[]
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
0
Suspicious (< 10 engines)
5
Clean (0 engines)
15
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR