This technique, called authenticode stuffing, allows for the insertion of data into a certificate table while keeping the digital signature intact. ScreenConnect abused for initial access.