# Microsoft Defender DigiCert False Positive: Trojan:Win32/Cerdigent.A!dha

> Microsoft Defender is incorrectly identifying DigiCert root certificates as the Cerdigent trojan, causing certificate removal and enterprise disruptions.

- Published: 2026-05-03T20:17:15.000Z
- Severity: medium
- Category: Threat Intel
- Tags: Microsoft Defender, Digicert, False Positive, Trojan Win32 Cerdigent a Dha, Certificate Security
- Author: Runtime Rebel Intel
- Primary source: https://www.bleepingcomputer.com/news/security/microsoft-defender-wrongly-flags-digicert-certs-as-trojan-win32-cerdigentadha/
- Canonical: https://runtimerebel.com/blog/microsoft-defender-digicert-false-positive-trojan-win32-cerdigent-a-dha

## Key points

- Immediate impact: Microsoft Defender identifies DigiCert root certificates as malware, leading to system-wide trust issues and potential application failures across Windows environments.
- Affected systems: Windows systems running Microsoft Defender with specific signature updates are incorrectly flagging the Trojan:Win32/Cerdigent.A!dha threat.
- Remediation: Organizations should update Microsoft Defender intelligence definitions to the latest version and verify the integrity of the local certificate store.

Microsoft Defender recently began flagging legitimate DigiCert root certificates as a malicious threat, specifically identifying them as `Trojan:Win32/Cerdigent.A!dha`. This incident, according to [BleepingComputer](https://www.bleepingcomputer.com/news/security/microsoft-defender-wrongly-flags-digicert-certs-as-trojan-win32-cerdigentadha/), has resulted in widespread false-positive alerts across Windows environments and, in many cases, led to the automated removal or quarantine of critical certificates. When a root certificate is removed from the system's Trusted Root Certification Authorities store, the chain of trust for numerous applications and services is broken, leading to TLS/SSL handshake failures and application crashes.

## Technical Analysis and Microsoft Defender DigiCert Certificate Removal Fix

The detection nomenclature used by Microsoft, specifically the `!dha` suffix, typically indicates a detection based on cloud-delivered heuristics or behavioral analysis rather than a traditional static signature. This suggests that a change in Microsoft’s cloud-based scanning logic incorrectly associated the metadata or thumbprints of DigiCert root certificates with known [IoC](/glossary#ioc) patterns for the Cerdigent malware family. For [SOC](/glossary#soc) analysts, this creates a significant burden as they must differentiate between a legitimate security breach and a systemic failure of their primary [EDR](/glossary#edr) solution.

The removal of these certificates is particularly disruptive because it prevents Windows from verifying the identity of software publishers and secure websites. This can lead to a cascade of errors where security software itself may fail to update, or internal enterprise applications stop functioning because they can no longer establish secure connections. To address this, administrators must implement a **Microsoft Defender DigiCert certificate removal fix** by first ensuring that security intelligence definitions are updated to a version where Microsoft has suppressed the false detection. If the certificate has already been removed, it may need to be manually re-imported via Group Policy or local administrative tools to restore the environment to a functional state.

### Operational Impact on Enterprise Infrastructure

False positives of this magnitude can lead to alert fatigue within a [SIEM](/glossary#siem) or security platform, as the sheer volume of detections for a common root certificate can overwhelm automated response playbooks. Furthermore, the incident highlights the risks of automated remediation in modern security stacks. While rapid response is essential for mitigating a legitimate [Supply Chain Attack](/glossary#supply-chain-attack), automated actions taken on trusted system components like root certificates can cause more downtime than the threats they are designed to stop. Organizations practicing [Zero Trust](/glossary#zero-trust) architecture are also affected, as the underlying trust in the identity of the device and its certificates is temporarily invalidated.

### Detection and Mitigation Guidance

Security teams should monitor their consoles for any alerts matching the `Trojan:Win32/Cerdigent.A!dha` signature. When investigating, it is vital to know **how to detect Trojan:Win32/Cerdigent.A!dha false positive** signals versus genuine malware. A key indicator is the file path: if the detection points to a certificate file or a process interacting with the Windows Certificate Store (certutil.exe or system processes), it is likely the false positive in question. In contrast, typical [Phishing](/glossary#phishing) or malware campaigns would target user directories or temporary folders.

To remediate the issue:

*   Trigger a manual update of Microsoft Defender signatures using the command line: `MpCmdRun.exe -SignatureUpdate`.
*   Verify the presence of DigiCert Global Root G2 or other affected certificates in the `Cert:\LocalMachine\Root` store.
*   Audit [SOC](/glossary#soc) logs for any automated quarantine actions that may have removed valid binaries or configuration files associated with these certificates.
*   Communicate with end-users and helpdesk staff to explain that 'untrusted certificate' errors are currently being addressed as part of a global security software update.

**Related:** [Cookie-Controlled PHP Web Shells Evade Detection on Linux Servers](/blog/cookie-controlled-php-web-shells-evade-detection-on-linux-servers), [EngageLab SDK Vulnerability: Protecting Crypto Wallets from Sandbox Bypass](/blog/engagelab-sdk-vulnerability-protecting-crypto-wallets-from-sandbox-bypass)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/microsoft-defender-digicert-false-positive-trojan-win32-cerdigent-a-dha