Detecting Catalog-Hygiene and Signing-Trust Abuse#

Table of Contents#

1. How Catalog Trust Works
2. The Two Abuse Paths
3. Detection Signal 1 — Catalog File Integrity
4. Detection Signal 2 — Stale/Previous-Version Script Hosts
5. Detection Signal 3 — Unsigned Code Treated as Trusted
6. A Sigma Rule for the Family
7. Operationalising Catalog Monitoring
8. References

1. How Catalog Trust Works#

A security catalog (.cat) is a signed container of cryptographic hashes for a set of files. Windows uses catalogs to attest to the integrity of files that ship without their own embedded Authenticode signature — typically drivers and system binaries. When a process or the kernel needs to verify such a file, it can look up the file’s hash in an installed catalog; if found, the file is treated as trusted by virtue of the catalog’s signature.

WDAC honours this. A policy that grants trust on catalog-signed content (which many do, because the Windows driver ecosystem depends on it) inherits an obligation: the catalog infrastructure itself must be integrity-protected. The abuse family below is what happens when that obligation is weak.

2. The Two Abuse Paths#

• Catalog-hygiene abuse — Jimmy Bayn’s Abusing Catalog Hygiene documents how lax catalog maintenance lets an attacker get unsigned code treated as catalog-trusted, laundering it past an application-control policy that trusts catalog signatures.
• Previous-version signed script hosts + catalogs — William Easton’s VULN-051861 advisory covers using older, still-trusted copies of signed script hosts (whose current versions are on the block list) alongside catalog files to bypass WDAC. The block list blocks the current binary, not every historical version whose signature is still valid.

Both paths share the same root cause: trust that was meant to be scoped to a specific, maintained artifact is instead being satisfied by a stale or tampered substitute.

3. Detection Signal 1 — Catalog File Integrity#

Catalogs live under C:\Windows\System32\catroot and C:\Windows\System32\catroot2 (the Cryptographic Services working directories). Detection posture:

• Monitor writes, creation, and replacement of .cat files outside the OS servicing process (TiWorker.exe, TrustedInstaller.exe, msiexec.exe, Windows Update).
• Alert on catalog files appearing in non-standard locations (user-writable paths, alongside an attacker payload).
• Track catalog hash inventory per host; a new or modified catalog that does not correspond to a Windows Update event is the signal.

4. Detection Signal 2 — Stale/Previous-Version Script Hosts#

The previous-version abuse requires an old copy of a signed script host (e.g. an older wscript.exe, cscript.exe, mshta.exe, or a signed PowerShell host) to be present and runnable. Detection:

• Inventory signed script-host binaries across the host and alert on duplicates outside their System32 install path (e.g. a second wscript.exe in a user directory or a backup folder).
• Alert on execution of a script host whose version is older than the installed OS’s shipping version by a significant margin, especially when the current version is on your block list.
• Correlate script-host execution from non-System32 paths with the catalog-monitoring signal — a script host plus an unexpected catalog in the same directory tree is the fingerprint of this abuse.

5. Detection Signal 3 — Unsigned Code Treated as Trusted#

The strongest end-state signal: a file that you know is unsigned (or unsigned-by-the-expected-publisher) being loaded/executed as if it were trusted. This is observable through:

• Sysmon EID 7 (image load) where the loaded module has no signature but the loading process proceeds — paired with Microsoft-Windows-CodeIntegrity/Operational events showing catalog-based trust satisfaction.
• Code-integrity audit mode events (EID 3076/3077/3089) that name the catalog used to satisfy trust for a given file.

Running WDAC in audit mode alongside enforcement, and forwarding the audit events, gives you this visibility directly.

6. A Sigma Rule for the Family#

A file-event rule for catalog tampering and a process rule for stale script-host execution. The catalog branch requires a Sysmon file-audit configuration targeting .cat paths.

1
title: WDAC Bypass — Catalog Tamper or Stale Signed Script Host
2
id: 4d7f1a2b-9c3e-4f6a-8d2b-1e5c7a9b3d4e
3
status: experimental
4
description: >
5
  Detects abuse of Windows security catalog trust or previous-version signed
6
  script hosts to launder unsigned code past application control — catalog
7
  file writes outside OS servicing, or execution of duplicate/old script
8
  hosts from non-system paths.
9
references:
10
  - https://bohops.com/2019/05/04/abusing-catalog-file-hygiene-to-bypass-application-whitelisting/
11
  - https://github.com/strawgate/Advisories/blob/main/Microsoft/VULN-051861.md
12
  - /posts/wdac-bypass-techniques-reference-catalog/
13
author: Anubhav Gain
14
date: 2026/07/13
15
tags:
16
  - attack.defense_evasion
17
  - attack.t1553
18
  - attack.t1218
19
logsource:
20
  product: windows
21
  category: file_event
22
detection:
23
  catalog_write:
24
    TargetFilename|endswith: '.cat'
25
    TargetFilename|contains:
26
      - '\catroot'
27
      - '\catroot2\'
28
      - '\Users\'
29
      - '\AppData\'
30
      - '\Temp\'
31
      - '\ProgramData\'
32
    filter_servicing:
33
      Image|endswith:
34
        - '\TiWorker.exe'
35
        - '\TrustedInstaller.exe'
36
        - '\msiexec.exe'
37
        - '\setup.exe'
38
        - '\wuauclt.exe'
39
        - '\UsoClient.exe'
40
    condition: catalog_write and not filter_servicing
41
  stale_script_host:
42
    Image|endswith:
43
      - '\wscript.exe'
44
      - '\cscript.exe'
45
      - '\mshta.exe'
46
    Image|contains:
47
      - '\Users\'
48
      - '\AppData\'
49
      - '\Temp\'
50
      - '\ProgramData\'
51
      - '\Downloads\'
52
condition: catalog_write or stale_script_host
53
fields:
54
  - TargetFilename
55
  - Image
56
  - User
57
falsepositives:
58
  - Legitimate driver/software installation via servicing components (filtered)
59
  - Authorised catalog updates through WSUS/Intune
60
level: high

(Note: in a real Sigma pipeline, the filter_servicing block’s nested condition is composed at the rule-engine level; the intent is “catalog write not from the OS servicing image set.”)

7. Operationalising Catalog Monitoring#

• Deploy a Sysmon configuration that audits .cat file create/rename/write under catroot, catroot2, and user-writable paths. This telemetry does not exist by default.
• Inventory script hosts. A one-time per-host inventory of wscript.exe/cscript.exe/mshta.exe/powershell.exe paths and versions, refreshed periodically, makes the stale-script-host detection trivial.
• Run WDAC audit mode in parallel. The Code Integrity operational log is the authoritative source for “which catalog satisfied trust for this file.” Forward it.
• Treat catalog trust as tier-0 infrastructure. The ability to add or modify a catalog is the ability to launder arbitrary code as trusted. Restrict and alert on it the way you would on code-integrity policy writes (see part 4).

8. References#

• Abusing Catalog Hygiene to Bypass Application Whitelisting — bohops
• Bypassing WDAC with Previous Versions of Signed Script Hosts & Catalogs — William Easton (@strawgate)
• WDAC Bypass Techniques — The Complete Reference Catalog
• Windows Security Catalogs and catroot — Microsoft Learn
• MITRE ATT&CK T1553 — Subvert Trust Controls
• MITRE ATT&CK T1553.003 — Code Signing