In this security tutorial: https://youtu.be/dykc9YC9Z6U?t=257

the author claims that "sihost is a network component of the malware..." (at 4:23). Yet, prior to his claim, at 3:09 he shows that that particular sihost is signed as Microsoft binary. So, it ought to be a Windows system module, correct?

I have read here that some bad dev suppliers had their malicious code signed by Microsoft in the past through its attestation signing process, but even then (if I understand correctly) the binary would have been signed by Microsoft with the name of the malicious dev company, not with the name of Microsoft themselves.

So, is it possible for a malware binary to be signed as Microsoft Corporation binary?


You must log in to answer this question.

Browse other questions tagged .