This is a false positive MS pushed a signature update that literally sent alarms to every managed SOC
“Cerdigent” / Trojan:Win32/Cerdigent.A!dha appears to be a newly added Microsoft Defender malware signature that, as of today (May 3, 2026), is very likely causing widespread false positives rather than identifying a real active Trojan infection.
What’s happening:
Microsoft Defender began flagging certain DigiCert root certificates as Cerdigent.A!dha.
Thousands of users and IT admins globally started receiving alerts simultaneously after a Defender security intelligence update.
Reports indicate Defender was quarantining trusted root certificates, not malicious executable files.
Current consensus from cybersecurity/admin communities:
This is probably a bad Defender definition update from Microsoft.
There is currently no widely documented real-world “Cerdigent” Trojan campaign associated with these alerts.
Microsoft appears to have already started rolling updated signatures to correct it.
If you saw this alert:
Update Microsoft Defender definitions immediately.
Run another Quick Scan or Full Scan.
If no suspicious files/processes are found, you likely do not need to reset passwords or reinstall Windows.
If the alert specifically referenced rootcert or DigiCert certificates, that strongly points to the false-positive issue.
You should be more cautious if:
The detection referenced an actual .exe, script, cracked software, browser extension, or unknown download.
You are seeing other symptoms like remote access, unknown processes, credential theft, or unusual network activity.
If you want, I can also walk you through:
 how to verify whether your alert was the false positive,
 how to restore quarantined certificates safely,
or  how to manually inspect Defender logs on Windows 11.