1. Home
  2. ATT&CK Techniques
  3. T1553.002 Code Signing

T1553.002 Code Signing

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) The certificates used during an operation may be created, acquired, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates) Unlike Invalid Code Signature, this activity will result in a valid signature.

Code signing to verify software on first run can be used on modern Windows and macOS systems. It is not used on Linux due to the decentralized nature of the platform. (Citation: Wikipedia Code Signing)(Citation: EclecticLightChecksonEXECodeSigning)

Code signing certificates may be used to bypass security policies that require signed code to execute on a system.

View in MITRE ATT&CK®

VERIS Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1553.002 Code Signing

Azure Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
azure_dedicated_hsm Azure Dedicated HSM technique_scores T1553.002 Code Signing
Comments
Certificate credentials can be vaulted in an HSM thereby reducing its attack surface.
References
  1. https://learn.microsoft.com/en-us/azure/dedicated-hsm/overview

AWS Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
aws_cloudhsm AWS CloudHSM technique_scores T1553.002 Code Signing
Comments
Use cases in documentation show that certificate credentials can be stored in AWS CloudHSM which reduces the attack surface and threat from these sub-techniques.
References
  1. https://docs.aws.amazon.com/cloudhsm/latest/userguide/use-cases.html#certificate-authority

M365 Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
DEF-AACI-E3 Adaptive Application Control Integration Technique Scores T1553.002 Code Signing
Comments
Once this control is activated, it generates alerts for any executable that is run and is not included in an allow list. While publisher-based allow lists may fail to detect malicious executables with valid signatures, hash and path-based rules will still detect untrusted executables. Events are calculated once every twelve hours, so its temporal score is Partial.
References
  1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent
  2. https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-servers-overview
  3. https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-defender-service-description
DEF-AACI-E3 Adaptive Application Control Integration Technique Scores T1553.002 Code Signing
Comments
Once this control is activated, it generates alerts for any executable that is run and is not included in an allow list. While publisher-based allow lists may fail to detect malicious executables with valid signatures, hash and path-based rules will still detect untrusted executables. Events are calculated once every twelve hours, so its temporal score is Partial.
References
  1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent
  2. https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-servers-overview
  3. https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-defender-service-description