File Creation with Signature or Certificate Extensions

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects the creation of files ending with '.sig', '.asc', or '.cer'. These extensions are commonly associated with digital signatures, PGP/GPG keys, and certificates, which could indicate activities like code signing, certificate generation/import, or PGP/GPG key manipulation by an adversary.