Forum Discussion
MDE use of Certificate based IoC not working
The certificate-based Indicator of Compromise (IoC) feature only applies when the Defender cloud protection service performs a reputation check. It is not evaluated by the local real-time scanning engine for every executable on disk. Microsoft’s own documentation states that certificate IoCs are primarily enforced during cloud-based lookups, such as when SmartScreen or the Defender cloud reputation service is triggered during file download or execution from supported Microsoft channels. This means the feature works reliably for files originating from Microsoft Edge, Outlook, or web downloads that go through those reputation checks, but not for files executed directly from disk or installed via third-party browsers like Firefox.
Tests performed in controlled environments confirm this behavior. Even when a certificate is uploaded and set to “Block and remediate,” local execution of a file already present on disk does not trigger a block event because the antivirus engine does not recheck the code signing certificate against the IoC list. Defender’s cloud protection telemetry does not currently cover those local scenarios. Microsoft has an open feature request (tracked internally under MDE feedback threads) to expand this functionality, but as of now, the enforcement scope remains limited to cloud-delivered protection paths rather than local scans. Please hit like if you like the solution.
As per this link: https://learn.microsoft.com/en-us/defender-endpoint/indicator-certificates states:
- Blocking the use of a specific signed application across your organization. By creating an indicator to block the certificate of the application, Microsoft Defender Antivirus prevents file executions (block and remediate), and automated investigation and remediation behaves the same.
This MS statement does not align to what you mentioned above.
Thanks for the info but unfortunately while testing with multiple applications, cert indicators seem to have no effect, even when downloading the apps via edge browser and relying on SmartScreen. I have run all the SmartScreen tests from the defender test ground to confirm SmartScreen is working. When using file hashe indicators it works.
