Sigverif.exe

Launch sigverif.exe GUI, click 'Advanced', specify arbitrary executable path as 'log file name', then click 'View Log' to execute the binary.

Use Execute arbitrary programs through a trusted Microsoft-signed binary to bypass application whitelisting.

sigverif.exe

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1218

Detection

IOC: sigverif.exe spawning unexpected child processes

Refs

twitter.com/0gtweet/status/1457676633809330184

www.hexacorn.com/blog/2018/04/27/i-shot-the-sigverif-exe-the-gui-based-lolbin/

lolbas-project.github.io/lolbas/Binaries/Sigverif/