Threat actors can buy access to hacked vendor accounts and stolen certificates via the dark web, then they use those certificates to sign their malware. Microsoft stated, “it’s important to understand that the techniques used in this attack occur post exploitation, meaning an attacker must either have already gained administrative privileges in order to be able to run the installer to update the registry and install the malicious driver the next time the system boots or convince the user to do it on their behalf.” Threat actors gain access to a system via a malware strain, then install a signed driver to gain admin access on the host. Although it is rare to find malware signed by Microsoft, a much more common scenario observed by Binary Defense Threat Researchers is malware signed with a digital certificate issued to a little-known company. These software signing certificates are usually issued just days or hours before the malware is distributed, so hunting for recently signed programs can sometimes yield useful results for enterprise defenders.

https://therecord.media/microsoft-admits-to-signing-a-malicious-rootkit-driver/

https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/