Cross-source coverage

T1553.002 / ATT&CK

Subvert Trust Controls: Code Signing

5 rules across 3 sources.

From MITRE ATT&CK 19.2

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. The certificates used during an operation may be created, acquired, or stolen by the adversary. Unlike Invalid Code Signature, this activity will result in a valid signature.

Code signing to verify software on first run can be used on modern Windows and macOS systems. It is not used on Linux due to the decentralized nature of the platform.

Code signing certificates may be used to bypass security policies that require signed code to execute on a system.

Platforms
macOS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonmacos:unifiedlog

How MITRE says to detect it DET0230

Detect Suspicious or Malicious Code Signing Abuse

Windows Analytic 0643

Detects execution of binaries signed with unusual or recently issued certificates, correlation of process execution with abnormal publisher metadata, and mismatched certificate chains. Monitors for revoked or unknown code signing certificates used in high-privilege contexts.

  • WinEventLog:Security EventCode=4688
  • WinEventLog:Sysmon EventCode=7

macOS Analytic 0644

Monitors Gatekeeper, spctl, and unified log entries for binaries executed with unexpected or untrusted signatures. Correlates file metadata changes with process launches where signature validation is skipped, altered, or fails but the process still executes.

  • macos:unifiedlog Code signing verification failures or bypassed trust decisions
  • macos:unifiedlog Execution of binaries with unsigned or anomalously signed certificates

View on attack.mitre.org ↗

elastic/detection-rules

3 rules
Detection Severity Format
Potential Masquerading as System32 DLL High Elastic TOML
Expired or Revoked Driver Loaded Medium Elastic TOML
Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601 - CurveBall) Low Elastic TOML

Azure/Azure-Sentinel

1 rule
Detection Severity Format
Short-lived ephemeral code signing certificates Undefined KQL

SigmaHQ/sigma

1 rule
Detection Severity Format
Potential Secure Deletion with SDelete Medium Sigma

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.