WDAC File Rule Level: LeafCertificate#

1
Root CA (self-signed, universally trusted)
2
  └── Intermediate CA (issued by Root, issues certs to others)
3
        └── Leaf Certificate (issued to vendor, used to actually sign files)
4
              └── Signed binary (exe, dll, sys...)

1
graph TD
2
    Root["Root CA\nCN=DigiCert Global Root G2\nSelf-signed\nTrusted by Windows root store\nNot directly used in any WDAC rule level"]
3

4
    Intermediate["Intermediate CA (PCA)\nCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021\nIssued by Root CA\n★ PcaCertificate level: TBS hash anchors here\n★ Publisher level: TBS hash anchors here (+ leaf CN check)\n★ FilePublisher level: TBS hash anchors here (+ leaf CN + file attrs)"]
5

6
    Leaf["Leaf Certificate (End-Entity)\nCN=Acme Software Inc\nSerial: 0A:1B:2C:3D...\nValid: 2024-01-01 to 2025-12-31\nPrivate key held by Acme\n★★ LeafCertificate level: TBS hash of THIS cert used\nBreaks when cert expires and is replaced"]
7

8
    File1["signed_app.exe\nSigned with Acme's private key\nAuthenticode signature embeds leaf cert\n+ chain up to root"]
9

10
    File2["setup.exe\nAlso signed by Acme\nSame leaf cert → same TBS hash\nSame LeafCertificate rule covers this too"]
11

12
    NewLeaf["NEW Leaf Certificate (after renewal)\nCN=Acme Software Inc (same CN!)\nSerial: 9F:8E:7D:6C... (DIFFERENT)\nValid: 2026-01-01 to 2027-12-31\nDIFFERENT TBS HASH → LeafCertificate rule breaks\nPublisher rule still works (same CN)"]
13

14
    Root -->|"issued"| Intermediate
15
    Intermediate -->|"issued"| Leaf
16
    Leaf -->|"signs"| File1
17
    Leaf -->|"signs"| File2
18
    Intermediate -->|"also issues"| NewLeaf
19

20
    style Root fill:#1a0d2e,stroke:#6b21a8,color:#d8b4fe
21
    style Intermediate fill:#162032,stroke:#1e3a5f,color:#e2e8f0
22
    style Leaf fill:#0d1f12,stroke:#1a5c2a,color:#86efac
23
    style File1 fill:#0d1f12,stroke:#1a5c2a,color:#86efac
24
    style File2 fill:#0d1f12,stroke:#1a5c2a,color:#86efac
25
    style NewLeaf fill:#1f0d0d,stroke:#7f1d1d,color:#fca5a5

1
graph LR
2
    subgraph Chain["Certificate Chain"]
3
        R["Root CA"]
4
        I["Intermediate CA\n(PCA)"]
5
        L["Leaf Cert\n(End-Entity)"]
6
        F["Signed File"]
7
        R --> I --> L --> F
8
    end
9

10
    subgraph Rules["WDAC Rule Levels"]
11
        PCA_Rule["PcaCertificate\nTBS hash of Intermediate\nTrusts ALL files signed\nby ANY cert from this CA\nBroadest cert-based trust"]
12
        Pub_Rule["Publisher\nTBS hash of Intermediate\n+ CN of Leaf\nTrusts ALL files from\nthis specific company\nvia this CA"]
13
        Leaf_Rule["LeafCertificate\nTBS hash of Leaf directly\nTrusts ALL files signed\nby this SPECIFIC cert instance\nMost precise; expires with cert"]
14
        FPub_Rule["FilePublisher\nTBS hash of Intermediate\n+ CN of Leaf\n+ OriginalFileName\n+ MinimumFileVersion\nMost specific, most control"]
15
    end
16

17
    I -.->|"TBS hash"| PCA_Rule
18
    I -.->|"TBS hash"| Pub_Rule
19
    L -.->|"CN only"| Pub_Rule
20
    L -.->|"TBS hash"| Leaf_Rule
21
    I -.->|"TBS hash"| FPub_Rule
22
    L -.->|"CN + file attrs"| FPub_Rule
23

24
    style R fill:#1a0d2e,stroke:#6b21a8,color:#d8b4fe
25
    style I fill:#162032,stroke:#1e3a5f,color:#e2e8f0
26
    style L fill:#0d1f12,stroke:#1a5c2a,color:#86efac
27
    style F fill:#162032,stroke:#1e3a5f,color:#e2e8f0
28
    style PCA_Rule fill:#1f0d0d,stroke:#7f1d1d,color:#fca5a5
29
    style Pub_Rule fill:#1a1a0d,stroke:#7a6a00,color:#fde68a
30
    style Leaf_Rule fill:#0d1f12,stroke:#1a5c2a,color:#86efac
31
    style FPub_Rule fill:#0d1f12,stroke:#1a5c2a,color:#86efac

1
flowchart TD
2
    Start(["File Execution Requested"])
3
    HasSig{"Valid Authenticode\nsignature?"}
4
    FPCheck{"FilePublisher check\n(PCA TBS + CN + FileName + Version)?"}
5
    PubCheck{"Publisher check\n(PCA TBS + Leaf CN)?"}
6
    LeafCheck{"LeafCertificate check\nLeaf cert TBS hash match?"}
7
    PCACheck{"PcaCertificate check\nPCA/Intermediate TBS hash?"}
8
    HashCheck{"Hash rule match?"}
9
    Allow_FP(["ALLOW via FilePublisher"])
10
    Allow_Pub(["ALLOW via Publisher"])
11
    Allow_Leaf(["ALLOW via LeafCertificate"])
12
    Allow_PCA(["ALLOW via PcaCertificate"])
13
    Allow_Hash(["ALLOW via Hash"])
14
    Block(["BLOCK"])
15

16
    Start --> HasSig
17
    HasSig -->|"Yes"| FPCheck
18
    HasSig -->|"No"| HashCheck
19
    FPCheck -->|"Match"| Allow_FP
20
    FPCheck -->|"No match"| PubCheck
21
    PubCheck -->|"Match"| Allow_Pub
22
    PubCheck -->|"No match"| LeafCheck
23
    LeafCheck -->|"Match"| Allow_Leaf
24
    LeafCheck -->|"No match"| PCACheck
25
    PCACheck -->|"Match"| Allow_PCA
26
    PCACheck -->|"No match"| HashCheck
27
    HashCheck -->|"Match"| Allow_Hash
28
    HashCheck -->|"No match"| Block
29

30
    style Start fill:#162032,stroke:#1e3a5f,color:#e2e8f0
31
    style Allow_FP fill:#0d1f12,stroke:#1a5c2a,color:#86efac
32
    style Allow_Pub fill:#0d1f12,stroke:#1a5c2a,color:#86efac
33
    style Allow_Leaf fill:#0d1f12,stroke:#1a5c2a,color:#86efac
34
    style Allow_PCA fill:#0d1f12,stroke:#1a5c2a,color:#86efac
35
    style Allow_Hash fill:#0d1f12,stroke:#1a5c2a,color:#86efac
36
    style Block fill:#1f0d0d,stroke:#7f1d1d,color:#fca5a5
37
    style HasSig fill:#1a1a0d,stroke:#7a6a00,color:#fde68a
38
    style LeafCheck fill:#1a0d2e,stroke:#6b21a8,color:#d8b4fe
39
    style FPCheck fill:#162032,stroke:#1e3a5f,color:#e2e8f0
40
    style PubCheck fill:#162032,stroke:#1e3a5f,color:#e2e8f0
41
    style PCACheck fill:#162032,stroke:#1e3a5f,color:#e2e8f0
42
    style HashCheck fill:#1a1a0d,stroke:#7a6a00,color:#fde68a

1
graph TD
2
    Attacker(["Attacker Goal:\nRun malicious binary\nby defeating LeafCertificate rule"])
3

4
    A1["Attack 1: Unsigned malicious binary"]
5
    A1R(["BLOCKED\nNo signature, default deny applies"])
6

7
    A2["Attack 2: Self-signed binary\nAttacker creates their own cert\nSigns malicious binary"]
8
    A2R(["BLOCKED\nSelf-cert TBS hash ≠ Leaf cert TBS hash\nNo match"])
9

10
    A3["Attack 3: Get different code signing cert\nfrom same CA (DigiCert)\nSame issuer, different key"]
11
    A3R(["BLOCKED\nDifferent cert = different TBS hash\nLeafCertificate is more resistant\nthan Publisher to this attack"])
12

13
    A4["Attack 4: Steal leaf cert private key\nSign malicious binary with stolen key"]
14
    A4R(["ALLOWED\nPrivate key theft gives full impersonation\nAny binary signed with stolen key passes\nRequires access to vendor's signing infra"])
15

16
    A5["Attack 5: Same CN, different CA\nGet cert from Sectigo with same CN\nas target vendor"]
17
    A5R(["BLOCKED\nDifferent CA = different cert = different TBS hash\nLeafCertificate is resistant to this\n(Publisher would also block this)"])
18

19
    A6["Attack 6: Wait for cert to expire\nDeploy old signed binary after policy\nnot yet updated for new cert"]
20
    A6R(["Depends on timing\nIf old cert still valid and rule present: ALLOWED\nIf old cert expired + policy not updated:\nNew files blocked — but old signed files\nstill match old rule if timestamps valid"])
21

22
    Attacker --> A1 & A2 & A3 & A4 & A5 & A6
23
    A1 --> A1R
24
    A2 --> A2R
25
    A3 --> A3R
26
    A4 --> A4R
27
    A5 --> A5R
28
    A6 --> A6R
29

30
    style Attacker fill:#1f0d0d,stroke:#7f1d1d,color:#fca5a5
31
    style A1 fill:#162032,stroke:#1e3a5f,color:#e2e8f0
32
    style A2 fill:#162032,stroke:#1e3a5f,color:#e2e8f0
33
    style A3 fill:#162032,stroke:#1e3a5f,color:#e2e8f0
34
    style A4 fill:#162032,stroke:#1e3a5f,color:#e2e8f0
35
    style A5 fill:#162032,stroke:#1e3a5f,color:#e2e8f0
36
    style A6 fill:#162032,stroke:#1e3a5f,color:#e2e8f0
37
    style A1R fill:#0d1f12,stroke:#1a5c2a,color:#86efac
38
    style A2R fill:#0d1f12,stroke:#1a5c2a,color:#86efac
39
    style A3R fill:#0d1f12,stroke:#1a5c2a,color:#86efac
40
    style A4R fill:#1f0d0d,stroke:#7f1d1d,color:#fca5a5
41
    style A5R fill:#0d1f12,stroke:#1a5c2a,color:#86efac
42
    style A6R fill:#1a1a0d,stroke:#7a6a00,color:#fde68a

1
flowchart TD
2
    Q1{"Is this an internal/private\nCA where you control\nall certificate issuance?"}
3
    Q2{"Does the vendor publish\ncert rotation schedules\nand you have automation\nfor policy updates?"}
4
    Q3{"Are you concerned\nabout another company\nhaving the same CN on\nthe same public CA?"}
5
    Q4{"Is this a high-sensitivity\nenvironment requiring\nmaximum cert-level precision?"}
6
    Q5{"Are there fewer than\n10 vendors to manage?"}
7

8
    UseLeaf(["LeafCertificate is appropriate\nBut document cert expiry dates"])
9
    UsePublisher(["Prefer Publisher\nBetter longevity, lower maintenance"])
10
    UseHash(["Use Hash for maximum control\nand precision"])
11
    MaybeLeaf(["LeafCertificate may be viable\nif you have operational discipline"])
12
    AvoidLeaf(["Avoid LeafCertificate\nMaintenance cost exceeds benefit"])
13

14
    Q1 -->|"Yes"| UseLeaf
15
    Q1 -->|"No"| Q2
16
    Q2 -->|"Yes, fully automated"| Q3
17
    Q2 -->|"No, manual process"| Q5
18
    Q3 -->|"Yes, critical concern"| Q4
19
    Q3 -->|"No, not a concern"| UsePublisher
20
    Q4 -->|"Yes"| MaybeLeaf
21
    Q4 -->|"No"| UsePublisher
22
    Q5 -->|"Yes, manageable"| MaybeLeaf
23
    Q5 -->|"No, too many"| AvoidLeaf
24

25
    style UseLeaf fill:#0d1f12,stroke:#1a5c2a,color:#86efac
26
    style UsePublisher fill:#1a1a0d,stroke:#7a6a00,color:#fde68a
27
    style UseHash fill:#162032,stroke:#1e3a5f,color:#e2e8f0
28
    style MaybeLeaf fill:#1a1a0d,stroke:#7a6a00,color:#fde68a
29
    style AvoidLeaf fill:#1f0d0d,stroke:#7f1d1d,color:#fca5a5
30
    style Q1 fill:#162032,stroke:#1e3a5f,color:#e2e8f0
31
    style Q2 fill:#162032,stroke:#1e3a5f,color:#e2e8f0
32
    style Q3 fill:#162032,stroke:#1e3a5f,color:#e2e8f0
33
    style Q4 fill:#162032,stroke:#1e3a5f,color:#e2e8f0
34
    style Q5 fill:#162032,stroke:#1e3a5f,color:#e2e8f0

1
<Signer ID="ID_SIGNER_LEAF_SHA256" Name="Acme Software Inc (SHA-256 cert)">
2
  <CertRoot Type="TBS" Value="AABB..."/>  <!-- SHA-256 chain leaf TBS hash -->
3
</Signer>
4

5
<Signer ID="ID_SIGNER_LEAF_SHA1" Name="Acme Software Inc (SHA-1 cert)">
6
  <CertRoot Type="TBS" Value="1122..."/>  <!-- SHA-1 chain leaf cert TBS hash -->
7
</Signer>

1
sequenceDiagram
2
    participant SecTeam as Security Team
3
    participant InternalCA as Internal PKI / CA
4
    participant BuildSys as Build System
5
    participant PS as PowerShell ConfigCI
6
    participant MDM as Intune MDM
7
    participant Endpoints as Managed Endpoints
8

9
    Note over SecTeam,Endpoints: Initial Deployment
10

11
    SecTeam->>InternalCA: Request code signing cert for vuln-scanner
12
    InternalCA-->>BuildSys: Issue cert (CN=SecurityScanTool, Valid 2024-2026)
13
    BuildSys->>BuildSys: Sign vuln-scanner.exe with issued leaf cert
14
    SecTeam->>PS: New-CIPolicyRule -Level LeafCertificate -FilePath vuln-scanner.exe
15
    PS->>PS: Extract leaf cert TBS hash from vuln-scanner.exe signature
16
    PS-->>SecTeam: <Signer CertRoot TBS=[leaf cert hash]/>
17
    SecTeam->>MDM: Deploy policy with LeafCertificate rule
18
    MDM->>Endpoints: Push policy
19
    Endpoints->>Endpoints: vuln-scanner.exe: leaf TBS hash matches ✓ ALLOWED
20

21
    Note over SecTeam,Endpoints: 18 months later: cert nearing expiry
22

23
    SecTeam->>InternalCA: Renew cert (new key pair, same CN)
24
    InternalCA-->>BuildSys: New cert (same CN, DIFFERENT TBS hash)
25
    BuildSys->>BuildSys: Sign new vuln-scanner.exe with NEW cert
26
    SecTeam->>PS: New-CIPolicyRule -Level LeafCertificate -FilePath new-vuln-scanner.exe
27
    PS-->>SecTeam: New <Signer> with NEW TBS hash
28
    SecTeam->>MDM: Update policy with BOTH old and new Signer rules
29
    MDM->>Endpoints: Push updated policy
30

31
    Note over SecTeam,Endpoints: Transition period: both old and new cert trusted
32

33
    SecTeam->>MDM: Remove old rule after all endpoints updated
34
    MDM->>Endpoints: Final policy with only new cert rule
35

36
    style SecTeam fill:#162032,stroke:#1e3a5f,color:#e2e8f0
37
    style InternalCA fill:#1a0d2e,stroke:#6b21a8,color:#d8b4fe
38
    style BuildSys fill:#162032,stroke:#1e3a5f,color:#e2e8f0
39
    style PS fill:#1a0d2e,stroke:#6b21a8,color:#d8b4fe
40
    style MDM fill:#162032,stroke:#1e3a5f,color:#e2e8f0
41
    style Endpoints fill:#0d1f12,stroke:#1a5c2a,color:#86efac