Netskope Threat Labs

MALWARE-OTHER Revoked.CRT.HookSignTool maliciously signed driver download

IPS-SWG

13 SIDs: 61807, 61809, 61811, 61813, 61815, 61817, 61819, 61821, 61823, 61825, 61827, 61829, 61831

First seen
June 2023
Last seen
October 2026

Detects payload download activity associated with the Revoked.CRT.HookSignTool maliciously signed driver malware family.