Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32/Cerdigent.A!dha

title: AHackaday IOC starter detection id: ahackaday-2026-05-03-microsoft-defender-wrongly-flags-digicert-certs-as-trojan-win32-cerdigent-a-dha-b296d99a description: IOC starter rule for Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32/Cerdigent.A!dha status: experimental author: ahackaday logsource: product: network detection: selection_iocs: - "https://www.bleepingcomputer.com/news/security/microsoft-defender-wrongly-flags-digicert-certs-as-trojan-win32-cerdigentadha/" - "www.bleepingcomputer.com" condition: selection_iocs falsepositives: - unknown level: medium

rule ahackaday_2026_05_03_microsoft_defender_wrongly_flags_digicert_certs_as_trojan_win32_cerdigent_a_dha_b296d99a { meta: description = "IOC starter for Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32/Cerdigent.A!dha" author = "ahackaday" strings: $ioc1 = "https://www.bleepingcomputer.com/news/security/microsoft-defender-wrongly-flags-digicert-certs-as-trojan-win32-cerdigentadha/" nocase $ioc2 = "www.bleepingcomputer.com" nocase condition: any of them }