AN0089
Analytic 0089
Windows
Execution of binaries with invalid digital signatures, where metadata claims code is signed but validation fails. Behavior is often correlated with suspicious parent processes or unexpected execution paths.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Windows Defender
Operational log
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
[SignatureValidationResult]
Allow tuning to include 'invalid', 'expired', or 'untrusted root' based on environment tolerance
[ParentProcessName]
Helps tune false positives by limiting to suspicious parent process executions
[TimeWindow]
Defines correlation window between metadata check and process execution
AN0090
Analytic 0090
macOS
Binaries or applications executed with tampered or unverifiable code signatures. Often tied to Gatekeeper bypasses, App Translocation, or use of unsigned launch daemons by untrusted users.
macos:unifiedlog
subsystem:syspolicyd
macos:endpointsecurity
ES_EVENT_TYPE_NOTIFY_EXEC
fs:fileevents
/var/log/install.log
[CodeSigningStatus]
Filters such as 'Unsigned', 'NotTrusted', or 'ModifiedSinceSigning' may vary by policy enforcement level
[UserContext]
Tune whether detection applies to all users or excludes trusted admin accounts
[ExecutablePathPrefix]
Enable tuning for known valid locations (e.g., /Applications) vs. suspicious paths (/Users/Shared)