In this security tutorial: https://youtu.be/dykc9YC9Z6U?t=257
the author claims that "sihost is a network component of the malware..." (at 4:23). Yet, prior to his claim, at 3:09 he shows that that particular sihost is signed as Microsoft binary. So, it ought to be a Windows system module, correct?
I have read here that some bad dev suppliers had their malicious code signed by Microsoft in the past through its attestation signing process, but even then (if I understand correctly) the binary would have been signed by Microsoft with the name of the malicious dev company, not with the name of Microsoft themselves.
So, is it possible for a malware binary to be signed as Microsoft Corporation binary?
