Add macOS Software Signing cert to exclusions for macOS 27

[shashank-elastic]

Pull Request

Issue link(s): NA

Summary - What I changed

• macOS 27 renames Apple's platform binary signing certificate CN from "Software Signing" to "macOS Software Signing", this adds the new CN alongside the old one in the affected rules to prevent false positives on Golden Gate hosts.

How To Test

Checklist

• Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
• Added the meta:rapid-merge label if planning to merge within 24 hours
• Secret and sensitive material has been managed correctly
• Automated testing was updated or added to match the most common scenarios
• Documentation and comments were added for features that require explanation

Contributor checklist

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?

[elastic-vault-github-plugin-prod]

⛔️ Test failed

Results

• ❌ Unusual Network Connection to Suspicious Web Service (kuery)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta

[Copilot]

🟢 Approval recommended

The reviewed change is focused and addresses the stated macOS 27 compatibility need.

Pull request overview

Updates a macOS detection rule to recognize Apple’s macOS 27 signing certificate name and prevent false positives.

Changes:

• Adds macOS Software Signing to trusted signer exclusions.
• Updates the rule metadata date.

File summaries

File	Description
rules/macos/command_and_control_unusual_network_connection_to_suspicious_web_service.toml	Adds the new macOS signing certificate exclusion.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[eric-forte-elastic]

I think this was in 26.6 as well: https://eclecticlight.co/2026/07/27/what-has-changed-in-macos-tahoe-26-6/

Looks good 👍

[elastic-vault-github-plugin-prod]

⛔️ Test failed

Results

• ❌ Unusual Network Connection to Suspicious Web Service (kuery)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta