MITRE ATT&CKsub-technique

T1632.001 Code Signing Policy Modification

Published 2022-03-30 Modified 2025-10-24 Official page ↗
Domain
mobile
Tactics
Defense Evasion
Platforms
Android, iOS
Version
1.1
Created
2022-03-30

Description

Adversaries may modify code signing policies to enable execution of applications signed with unofficial or unknown keys. Code signing provides a level of authenticity on an app from a developer, guaranteeing that the program has not been tampered with and comes from an official source. Security controls can include enforcement mechanisms to ensure that only valid, signed code can be run on a device. Mobile devices generally enable these security controls by default, such as preventing the installation of unknown applications on Android. Adversaries may modify these policies in a number of ways, including Input Injection or malicious configuration profiles.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1632 Subvert Trust Controls technique

Tactic · MITRE ATT&CK (1)

  • TA0030 Defense Evasion tactic

Referenced by MITRE ATT&CK · mitigates (3)

  • M1011 User Guidance mitigation
  • M1006 Use Recent OS Version mitigation
  • M1012 Enterprise Policy mitigation

Referenced by MITRE ATT&CK · uses (9)

  • S1056 TianySpy software (malware)
  • S0549 SilkBean software (malware)
  • S0551 GoldenEagle software (malware)
  • S0505 Desert Scorpion software (malware)
  • S0490 XLoader for iOS software (malware)
  • S0485 Mandrake software (malware)
  • G0112 Windshift group
  • S0420 Dvmap software (malware)
  • S0311 YiSpecter software (malware)

References