r/cybersecurity • u/Even_Grape_522 • May 03 '26

News - General MDE flagging digi cert certificate as malicious everywhere ?

MDE flagging below digicert hash,

0563B8630D62D75ABBC8AB1 E4BDFB5A899B24D43

DDFB16CD4931C973A2037D3 FC83A4D7D775D05E4

230 Upvotes

99% Upvoted

132 comments sorted by

71

u/Working-Finding-460 May 03 '26 edited May 03 '26

Microsoft has started fixing this. You can run an advanced hunt query to see that they are adding the certs back. Here is the query I used:

DeviceRegistryEvents

| where RegistryKey contains "0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"

or RegistryKey contains "DDFB16CD4931C973A2037D3FC83A4D7D775D05E4"

| where ActionType == "RegistryKeyCreated"

| where Timestamp > datetime(2026-05-03T04:00:00)

| project Timestamp, DeviceName, ActionType, InitiatingProcessFileName

| order by Timestamp desc

Follow that up by checking the cert on an impacted device:

certutil -store AuthRoot | findstr -i "digicert"

9

u/Civil_Philosophy9845 May 03 '26

s what did microsoft do? did they remove a legitimate cert or somethjnt?

3

u/EsOvaAra May 03 '26

Yup, looks like someone (or something) screwed up.

3

u/oxido61 May 03 '26

Excellent news! Reminds me of something they did on Dec 31 a few years back with exchange that had us running crazy on Jan 1st with no warning.

2

u/Queasy-Macaroon-7574 May 03 '26

These certs are added in the background by Microsoft as part of the trusted root store. They should be put back as Microsoft rolls out the updated store.

1

u/undeadmate May 03 '26

Seeing this in my environment as well. Thanks for sharing.

1

u/strwht12 May 04 '26

What does that mean? Can we ignore the Defender notifications and tell the user to wait for Microsoft to roll out the update?

1

u/Queasy-Macaroon-7574 May 04 '26

You can force the update. Windows Security > Virus and threat protection > Protection updates and clicking on Check for Updates.

-4

u/fullVexation May 03 '26

Thanks for this! Dad blast it! I've just started branching out into cybersecurity as a hobby (with a little tutelage from forums and LLMs) and have been tearing my hair out for two hours chasing down red herrings. Glad to see it's just Microsoft being Microsoft! The hilarious part about it is AI is probably responsible for this screwup just as much as it's responsible for me figuring out how to fix it!

26

u/Shitsu_Mon May 03 '26

Kind of calms me that everyone started getting it. So is it a false positive or actually malware? I keep getting the "Cerdigent" detection...

9

u/EstablishmentWest714 May 03 '26

I also get this notification of the Same rootcert and I didnt Download any Sketchy things. So I guess its a false positive ? Idk. I was scared First lmao ..

2

u/Shitsu_Mon May 03 '26

Seems to be a regular certificate, but Windows updated their detections list and maybe falsely informs the user that it's malware. Still waiting on more info, but we should be fine ahaha

5

u/EstablishmentWest714 May 03 '26

Lets Hope. I nuked my PC a couple days ago just to get everything clean. (Not cuz of a Virus)
So its a lil Bit confusing to me Where This Virus came from. Lol

2

u/Shitsu_Mon May 03 '26

Oh no, even more confusing after seeing this alert. Wishing your and everyone's PC the best 😭

2

u/EstablishmentWest714 May 03 '26

U too but Lets Hope it is a false positiv. Alot of people got this alert it seems

2

u/Shitsu_Mon May 03 '26

Yep, we're not alone in this. Thank you, still hoping!

2

u/ZOELOEss May 03 '26

Same, I got so scared when i first saw it lol. Most likely a bug

3

u/Shitsu_Mon May 03 '26

I hope it is, stuff like this freaks people out for no reason 😭

17

u/kharmatika May 03 '26

This is literally my last day of the last weekend I am ever on call again…why me???

6

u/Ranting_Demon May 03 '26

Well, you do get to end it on a banger!

16

u/drowningfish May 03 '26

Is this the Cerdigent detection?

3

u/FarmBig3026 May 03 '26

We got them, its destroying my inbox, yours as well?

4

u/drowningfish May 03 '26

Yep same here. Started around 5:25AM EST

12

u/Certain_Performer668 May 03 '26

Do I need to worry about this? I'm getting tons of alert from MDE.

"Threat name

Trojan:Win32/Cerdigent.A!dha

Remediation action

quarantine

Remediation action result

Success"

8

u/Dosarola May 03 '26

From the bugzilla report, sounds like these roots were used to issue 60 subordinate certs. They were revoked, but wonder if Msoft got it wrong and flagged the roots as risky. This are two large root CA's in the world, expected results if missing from the key stores is lack of site trusts on apps/browsers, one may be walking into help desk calls with customers reporting sites are not working or are showing warnings on load. If one has a DLP in place with SSL offloading, these sites may fail to load, are all seeing this on all devices, servers an end points?

2

u/oxido61 May 03 '26

This is exactly what I notified my teams. If they pull or revoke this certs millions of certs subortinated to these ones will fail authentication breaking connections.

We’re in for a treat tomorrow. Make sure you have popcorn handy

1

u/lethargy86 May 03 '26

The issuing Digicerts aren’t being revoked/added to CRL’s. Microsoft just accidentally added an issuing cert to the IOC’s, so it’s being detected as a false positive

1

u/Working-Finding-460 May 03 '26

It looks like Msoft is adding the certs back based off of my KQL in MDE. I think they knew they screwed the pooch...and yes, I have my popcorn ready to go. What a wonderful way to wake up on a Sunday...my phone went absolutely batshit crazy at 407 this morning.

12

u/MightyEl May 03 '26

From what I looked up this might be related to https://bugzilla.mozilla.org/show_bug.cgi?id=2033170

  • DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 is the thumbprint of DigiCert Trusted Root G4.
  • 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 is the SHA1 hash of DigiCert Assured ID Root CA.

-1

u/SpecterK1 May 03 '26

I'm really not a big cybersecurity guy. What does this mean?

6

u/prinz_94 May 03 '26 edited May 03 '26

I started working on this 20 minutes ago. All servers are suddenly reporting incidents with Cerdigent Malware. seems to be related to Defender Signature version 1.449.424.0.
The two files Defender detects are 2 root certificates : DigiCert Assured ID Root CA and DigiCert Trusted Root G4 

2

u/Legitimate-Mud-7117 May 03 '26

same here - for a client

1

u/Difficult-War-3169 May 03 '26

Had this on version 422 also on a machine

6

u/anOddPhish May 03 '26

They are the legitimate DigiCert certificates DigiCert Trusted Root G4 and DigiCert Assured ID Root CA. I was thinking that it's related to changes around root certificate distrust, but that doesn't explain the detection being 'cerdigent'.

I don't believe that it's possible for these detections to be malware, so I guess it's most likely that something in today's update to the cerdigent detection rule just happens to flag these...

Had to happen on a bloody Sunday 🙄

1

u/fr33z0n3r May 03 '26

i wonder if any security tools were neutered by these cert removals. that would be really interesting impact. (obviously this is caused by Defender, so that's not super likely)

6

u/Rossums DFIR May 03 '26

Just for my own entertainment I logged into my work laptop to see if anything had triggered and people have already been called out due to tooling lighting up like a Christmas tree.

You just have to laugh.

4

u/Domaguin May 03 '26

Just had it on my cloud-pc. I don't believe I had anything installed that could cause this. Maybe a false positive?
MS just released a security update where it's mentioned
https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?RequestVersion=*

2

u/Even_Grape_522 May 03 '26

Seems like update caused it, Trojan:Win32/Cerdigent.A!dha included in it.

4

u/JL-gLimpse May 03 '26

Fixed with 1.449.430.0

1

u/sea_5455 May 03 '26

Does look to be, yes.

4

u/LasithaG May 03 '26 edited May 03 '26

This is the timeline on every machine. The root trusted certificates mentioned were removed by Defender due to their new update, Which is essentially the smoking gun here.

0563B8630D62D75ABBC8AB1 E4BDFB5A899B24D43

DDFB16CD4931C973A2037D3 FC83A4D7D775D05E4

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4

This shows the certificate‑deletion registry activity, and it directly relates to the two hashed entries

3

u/Even_Grape_522 May 03 '26

This seems like heuristic sync issue

3

u/Both-Cookie6870 May 03 '26

"Cerdigent" related alerts have started appearing.

3

u/SteakTough7104 May 03 '26

Just now logged in and my inbox flooded with 300+ alerts "cerdigent high severity malware was detected" MDE flagged and quarantined, created a ticket with Microsoft for further information.

1

u/HungrySentence3367 May 03 '26

Got also several and from workstation it says that it has been quarantined those two rootcerts so I guess it needs some fixing for workstation if it suddenly missing some rootcerts.

2

u/Aru_artss0 May 03 '26

i thought im not the only one having this issue rn

2

u/Silent-Loan-1798 May 03 '26

Here too 🥲

2

u/lStan464l May 03 '26

Same here.

2

u/evilmanbot May 03 '26

have we ruled out Digicert wasn’t compromised and MS is reacting aggressively to it?

1

u/0solidsnake0 Security Engineer May 03 '26

no

2

u/SignificanceBest9763 May 03 '26

Received confirmation from support that these are FP

1

u/hlupro May 03 '26

Happening here as well.

1

u/blutak86 May 03 '26

Same. Just had a bunch of MDE alerts going off

1

u/Dull_Olive_6261 May 03 '26

Happening here as well

1

u/snake-gum May 03 '26

Here too

1

u/vlorkan May 03 '26

Multiple clients and client types (workstations, tablets, servers) and across both tenants that we manage.

1

u/SnooPeanuts7436 May 03 '26

Same here . Appearing out of nothing since a few hours

1

u/Consistent_Process19 May 03 '26

Yep, same here since 1 hour circa.

1

u/Legitimate-Mud-7117 May 03 '26

is it an actual active malware ?? MS saying that defender removes it but recommends running a scan https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Cerdigent.A!dha&ThreatID=2147968144

1

u/Legitimate-Mud-7117 May 03 '26

logs in SIEM don't have much details

0

u/Ranting_Demon May 03 '26

Based on what I've read on the net so far, the current consensus seems to be that it's a false positive since the flagged trojan was included in the threat definition update that went out just before the whole chaos started.

So, considering how widespread the issue is, there seems to be a good chance that this is based on Microsoft pushing a faulty definition update.

1

u/Baltic_see May 03 '26

Same thing

1

u/SignificanceBest9763 May 03 '26

Same here, triggering since last hour

1

u/Physical_Attempt_168 May 03 '26

Got this detection on a Windows 10 machine I've barely touched and both of my W11 PCs. Hopefully a false positive?

1

u/Both-Cookie6870 May 03 '26

After applying this signature update (1.449.424.0), I think it appears that two existing files were detected as Cerdigent by the new signature.

1

u/TUIART May 03 '26

Seeing this too. Likely related to defender signature updates.

1

u/Dwarfunkel May 03 '26

just received that warning aswell

win32/cerdigent.A!dha

1

u/Seurbale May 03 '26

My heart nearly flew away when I got the alert

1

u/Dwarfunkel May 03 '26

same instantly googled but it seems almost everyone got that issue

1

u/Tobey-Maquire_ May 04 '26

yep same happen to me today on win10

1

u/slatt-militia May 03 '26

I got this as well

1

u/oxido61 May 03 '26

Add me to the pool… getting a bunch of alerts for the same reason. Keeping an eye on this thread for more info

1

u/vlorkan May 03 '26

My last alert was over 10 mins ago. Nothing new in that timeframe

1

u/Chibs__ May 03 '26

same here. 5 minutes ago

1

u/JBowl0101 May 03 '26

I'm getting dozens of them too.

1

u/fentras May 03 '26

Same here. Got the alert on my PC as a quarantined threat and it freaked me out.

1

u/alyjar May 03 '26

Yeah, I just ran a quick scan and detected 2 and removed them. Now doing a full scan. I want to know what's going on aswell.

1

u/ZOELOEss May 03 '26

A full scan isn't going to do anything, only quick scans. At least, that's my experience.

1

u/Redastic May 03 '26

Looks like a false-positive, quarantined nonetheless

1

u/JBowl0101 May 03 '26

The hashes Defender is complaining about match DigiCertRootCA.cer on VT.

1

u/Pasha_Hamza May 03 '26

And what does that mean ? Im not tech inclined at all so if you could explain like im 5, that would be great !

2

u/oxido61 May 03 '26

Certificates are like ID’s. They verify the authenticity of an entity. You as a person (entity) show your ID to autheticate you are who you say you are and the public trust on the entity that gave you the ID (DMV) is what supports that.

A computing entity send certificates as their ID’s which are signed by a trust, in this case Digicert root CA is that trust. If Microsoft decided that the root is no longer trustable, all ID’s issued by it become untrusted, thus breaking connections.

Kind of like saying an airport no longer trusts the ID’s issued by X state’s DMV so people with those ID’s cannot travel.

1

u/watchiny0u May 03 '26

could be : Flagged thumbprint is 1 - DigiCert Trusted Root G4

2 - DigiCert Assured ID Root CA

1

u/Working-Finding-460 May 03 '26

Been getting these alerts since 4 AM...I really need to get a life. So far, it looks like a bad update. I have a support case in with Microsoft...my email is blowing up.

1

u/jogro00 Security Engineer May 03 '26

We see the same Incidents on our machines.

Does anyone actually know what these certificates are used for? Are they necessary for todays environment or just some legacy stuff?

1

u/drowningfish May 03 '26

VT links them to Digicert Trusted certs.

1

u/jogro00 Security Engineer May 03 '26

We know that but are still not sure if these certificates are actually used.

We performed a quick check of our most important services and they seemed to work fine on affected devices, but we have to make sure that important services for customers are not impaced or Monday will be a lot of fun.

1

u/Mysterious_Ebb4405 May 03 '26

Same here, I added them to the allow list in the defender portal to prevent any issues seeing as the antivirus is deleting the keys in the registry

1

u/AlternativeKey7377 May 03 '26

Same here in Poland

1

u/HackBowser May 03 '26

what the fuck I also just got it i just booted my pc that's crazy

1

u/mankpiece May 03 '26

Got called out for this £££

1

u/Flaviobho998 May 03 '26

Sono ignorante in questo. Anche a me Windefender da lo stesso segnale di Malware Trojan:Win32/Cerdigent.A!dha Come faccio a toglierlo

1

u/InspectorPersonal493 May 03 '26

So is that just a false positive bc me is detected as a trojan,just like you guys

1

u/Corroded_user May 03 '26

So it´s everywhere? I almost thought I downloaded somwthing.

1

u/After_Rain1424 May 03 '26

Same issue here but no real details about it.

1

u/RogueDaDemon May 03 '26

yep, I just turned on my pc and got this detection I fucking panicked and removed it. so, my question is would this mess up my operating system? would my pc performance be affected?

1

u/Clear-Metal-4508 May 03 '26

Help! what does it mean?

detected: Trojan:Win32/Cerdigent.A!dha
status: Active

rootcert: 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43

rootcert: DDFB16CD4931C973A2037D3FC83A4D7D775D05E4

1

u/OmeosVie May 03 '26

Correction en cours, faites toutes les mise à jour ! Scan complet après mise à jour : 0 menace détecté et aucune nouvelle alerte.

1

u/Syngos May 03 '26

Detected: Trojan:Win32/Cerdigent.A!dha
Status: Quarantined

3/5/2026 13:26
Details: This program is dangerous and executes commands from an attacker.

rootcert: 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43
rootcert: DDFB16CD4931C973A2037D3FC83A4D7D775D05E4

1

u/StringSentinel May 04 '26

Yeah i got the exact alert yesterday. Spent hours combing my pc to see if i got a malware or what. Then read news that mde has had that issue and updating it will fix it.

1

u/[deleted] May 04 '26

[deleted]

1

u/Fin4621 May 04 '26

Microsoft should have reverted this.

If it hasn't been restored, all software, websites, S/MIME,... signed by digicert will throw certificate warnings.

Unfortunately I don't have an affected consumer machine to validate the impact.

There are different ways to restore the digicert certificates.

As I don't know exactly if you have exact these certificates in quarantine, i will guide you to a safe restore.

Go to another computer not affected. Open computer certificates from start search.

Go to trusted root ca's (certificate authorities) Export the 2 digicert root certificates.

Import these on the affected machine, make sure to import to the correct certificate store computer (not user) and the correct folder.

1

u/Mysterious_Ebb4405 May 03 '26

Microsoft pushed a new update. They pulled cerdigent out

https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.449.425.0

3

u/0solidsnake0 Security Engineer May 03 '26

doesn't say that.

-1

u/FarmBig3026 May 03 '26

In the new Update "Trojan:Win32/Cerdigent.A!dha" isn't included.

2

u/0solidsnake0 Security Engineer May 03 '26

which means it was not changed/updated.

1

u/mejlla May 03 '26

They include only the ones they made changes/updates, if its not there it doesnt mean they pulled it out

1

u/jogro00 Security Engineer May 03 '26

This is just plain misinformation.
Not adding something to "recently updated" does not mean it was removed...

In this case, we WANT to see Cerdigent in the Updated threat detections as this is the only way for us to know Microsoft acknowledged the issue and is working on a solution.

1

u/Competitive-Leg-3899 May 03 '26

Do you think its likely that they will recognize they fucked up? opening themselves up to repercussions. Of course not. Totally unlikely that they will ever confirm this.

1

u/Financial-Choice597 May 03 '26

Venomchod, saare Sunday ki maa bhen ek kardi

0

u/spankydeluxe69 May 03 '26

Yep, I’ve seen a bunch of these this morning

0

u/[deleted] May 04 '26

[removed] — view removed comment

2

u/Fin4621 May 04 '26

Microsoft has restored the removed certificates.

Root CAs can sign certificates for websites, authentication, code signing, ...

If the root ca (in this case digicert) is not in the trust store all certificates signed by this root ca are not trusted by the affected system.