Techniques › T1553 › T1553.002
T1553.002 Code Signing
defense impairment — macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
2
analytics
1
Sigma rules tagged attack.t1553.002
0
KEV CVEs mapped here
<p>Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. The certificates used during an operation may be created, acquired, or stolen by the adversary. Unlike Invalid Code Signature, this activity will result in a valid signature.</p><p>Code signing to verify software on first run can be used on modern Windows and macOS systems. It is not used on Linux due to the decentralized nature of the platform.</p><p>Code signing certificates may be used to bypass security policies that require signed code to execute on a system.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0230 Detect Suspicious or Malicious Code Signing Abuse v1.0
AN0643 WindowsDetects execution of binaries signed with unusual or recently issued certificates, correlation of process execution with abnormal publisher metadata, and mismatched certificate chains. Monitors for revoked or unknown code signing certificates used in high-privilege contexts.Tunable:
AllowedCertificateAuthoritiesTimeWindowCertificateAgeThresholdAN0644 macOSMonitors Gatekeeper, spctl, and unified log entries for binaries executed with unexpected or untrusted signatures. Correlates file metadata changes with process launches where signature validation is skipped, altered, or fails but the process still executes.macos:unifiedlogCode signing verification failures or bypassed trust decisions→ DC0059 File Metadatamacos:unifiedlogExecution of binaries with unsigned or anomalously signed certificates→ DC0032 Process CreationTunable:DeveloperIDAllowListTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1553.002
Author: Thomas Patzke
· 2017-06-14 (modified 2024-12-13) · logsource: product=windows service=security · 39a80702-d7ca-4a83-b776-525b1f86a36d
Detects files that have extensions commonly seen while SDelete is used to wipe files.
Rules tagged at the parent level (attack.t1553) 4
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Matt Anderson (Huntress)
· 2024-07-23 · logsource: product=windows category=process_creation · 0090b851-3543-42db-828c-02fee986ff0b
Detects the use of software that is related to the University of California, Berkeley via metadata information.
This indicates it may be related to BOINC software and can be used maliciously if unauthorized.
Author: Matt Anderson (Huntress)
· 2024-07-23 · logsource: product=windows category=process_creation · 30d07da2-83ab-45d8-ae75-ec7c0edcaffc
Detects the execution of a renamed BOINC binary.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4
Detects when the macOS Script Editor utility spawns an unusual child process.
Author: Florian Roth (Nextron Systems), Maxime Thiebaut
· 2021-08-23 (modified 2024-12-01) · logsource: product=windows category=process_creation · a4eaf250-7dc1-4842-862a-5e71cd59a167
Detects a explorer.exe sub process of the RazerInstaller software which can be invoked from the installer to select a different installation folder but can also be exploited to escalate privileges to LOCAL SYSTEM