MITRE ATT&CKsub-technique
T1036.001 Invalid Code Signature
- Domain
- enterprise
- Tactics
- Stealth
- Platforms
- macOS, Windows
- Version
- 2.0
- Created
- 2020-02-10
Description
Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program. Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.
Unlike Code Signing, this activity will not result in a valid signature.
Related
Subtechnique of · MITRE ATT&CK (1)
- T1036 Masquerading technique
Tactic · MITRE ATT&CK (1)
- TA0005 Stealth tactic
Referenced by MITRE ATT&CK · mitigates (1)
- M1045 Code Signing mitigation
Referenced by MITRE ATT&CK · uses (12)
- G1058 The Gentlemen group
- S9050 Vidar software (malware)
- C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
- S1234 SplatCloak software (malware)
- S1050 PcShare software (tool)
- S0666 Gelsemium software (malware)
- G0112 Windshift group
- S0466 WindTail software (malware)
- G0067 APT37 group
- S0198 NETWIRE software (malware)
- S0019 Regin software (malware)
- S0128 BADNEWS software (malware)
Referenced by CAPEC · att&ck technique (1)
- CAPEC-473 Signature Spoof attack pattern
Referenced by Compliance · mitigates (6)
- CIS-16.12 Implement Code-Level Security Checks CIS Safeguard v8.1
- NIST-CM-2 Baseline Configuration NIST 800-53 control
- NIST-CM-6 Configuration Settings NIST 800-53 control
- NIST-IA-9 Service Identification and Authentication NIST 800-53 control
- NIST-SI-4 System Monitoring NIST 800-53 control
- NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control