---
id: 2064
title: "Tracking a stolen code-signing certificate with osquery"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2017/10/10/tracking-a-stolen-code-signing-certificate-with-osquery/"
published_at: "2017-10-10T12:53:35Z"
tags: ["supply-chain", "incident-response", "malware", "threat-hunting", "windows", "supply-chain-attack", "code-signing", "osquery", "authenticode", "ccleaner"]
phying_url: "https://phying.com/item/2064"
lang: en
---

# Tracking a stolen code-signing certificate with osquery

## Summary

Using osquery's new Windows Authenticode checks, Trail of Bits shows how to hunt binaries signed with the stolen certificate in the CCleaner supply chain attack that hit 2.27 million machines.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2017-10-10T12:53:35Z
- **Original:** https://blog.trailofbits.com/2017/10/10/tracking-a-stolen-code-signing-certificate-with-osquery/
- **Phying News:** https://phying.com/item/2064