MITRE ATT&CKsub-technique

T1553.002 Code Signing

Published 2020-02-05 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Defense Impairment
Platforms
macOS, Windows
Version
2.0
Created
2020-02-05

Description

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. The certificates used during an operation may be created, acquired, or stolen by the adversary. Unlike Invalid Code Signature, this activity will result in a valid signature. Code signing to verify software on first run can be used on modern Windows and macOS systems. It is not used on Linux due to the decentralized nature of the platform. Code signing certificates may be used to bypass security policies that require signed code to execute on a system.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1553 Subvert Trust Controls technique

Tactic · MITRE ATT&CK (1)

  • TA0112 Defense Impairment tactic

Referenced by MITRE ATT&CK · uses (93)

  • S9066 POLLBLEND software (malware)
  • S9067 TWOSTROKE software (malware)
  • S9052 MiniFast software (malware)
  • S9053 MiniJunk software (malware)
  • G1056 TeamPCP group
  • C0060 Operation AkaiRyū campaign
  • G1054 MirrorFace group
  • S9024 SPAWNCHIMERA software (malware)
  • G1051 Medusa Group group
  • S1240 RedLine Stealer software (malware)
  • S1239 TONESHELL software (malware)
  • S1232 SplatDropper software (malware)
  • S1233 PAKLOG software (malware)
  • S1235 CorKLOG software (malware)
  • S1238 STATICPLUGIN software (malware)
  • C0057 3CX Supply Chain Attack campaign
  • S1228 PUBLOAD software (malware)
  • S1226 BOOKWORM software (malware)
  • S1213 Lumma Stealer software (malware)
  • S1196 Troll Stealer software (malware)
  • S1197 GoBear software (malware)
  • C0047 RedDelta Modified PlugX Infection Chain Operations campaign
  • S1183 StrelaStealer software (malware)
  • C0040 APT41 DUST campaign
  • S1150 ROADSWEEP software (malware)
  • S1151 ZeroCleare software (malware)
  • S1149 CHIMNEYSWEEP software (malware)
  • G1034 Daggerfly group
  • G1031 Saint Bear group
  • G1015 Scattered Spider group
Show all 93 ›

Referenced by CAPEC · att&ck technique (3)

  • CAPEC-206 Signing Malicious Code attack pattern
  • CAPEC-473 Signature Spoof attack pattern
  • CAPEC-68 Subvert Code-signing Facilities attack pattern

References