CVE-2020-0601 | Netskope Threat Labs

Description

This detection identifies exploitation attempts targeting CVE-2020-0601, which has a HIGH severity rating. A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. A cyberattacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.

Stats

First seen: January 2022
Last seen: September 2026

CVEs

CVE-2020-0601

Alert name variants

Alert Name	Engine
Binary.Exploit.CVE-2020-0601	ATP Sandbox Adv. Heuristics
Exploit.CVE-2020-0601.Gen.1	AV
Exploit.CVE-2020-0601.Gen.2	ATP Sandbox Adv. HeuristicsAV
Win32.Exploit.CVE-2020-0601	ATP Sandbox Adv. Heuristics
Win64.Exploit.CVE-2020-0601	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-TOOLS CryptoAPI certificate spoofing tool download attempt	IPS-CFW
OS-WINDOWS Microsoft Windows CryptoAPI signed binary with spoofed certificate attempt	IPS-CFWIPS-SWG

Related blogs

Microsoft CryptoAPI Spoofing (CVE-2020-0601)

January 17, 20202 min read

Related families

Microsoft

References

nvd.nist.gov