tfMITRE ATT&CK sub-technique

Invalid Code Signature T1036.001

Tactic: Stealth
Platforms: macOS, Windows
Version: 2.0
Created: 10 February 2020
Last modified: 12 May 2026

Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program. Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware71st pct

Tools & malware71st percentile · 71% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Invalid Code Signature MITRE reference T1036.001

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

WindshiftG0112 ↗

Has used revoked certificates to sign malware.1 2

created 2020-06-252 referencesaka Bahamut

APT37G0067 ↗

Has signed its malware with an invalid digital certificates listed as “Tencent Technology (Shenzhen) Company Limited.”1

created 2018-04-181 referenceaka InkySquid

All 2 groups for this technique

Offense vs defense T1036.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Invalid Code Signature detection strategy DET0031

MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Invalid Code Signature Execution Detection via Metadata and Behavioral Context

Enterprise

2 platforms

AN0089 · Windows

Execution of binaries with invalid digital signatures, where metadata claims code is signed but validation fails. Behavior is often correlated with suspicious parent processes or unexpected execution paths.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File MetadataDC0059	WinEventLog:Windows Defender	Operational log
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SignatureValidationResult	Allow tuning to include 'invalid', 'expired', or 'untrusted root' based on environment tolerance
ParentProcessName	Helps tune false positives by limiting to suspicious parent process executions
TimeWindow	Defines correlation window between metadata check and process execution

AN0090 · macOS

Binaries or applications executed with tampered or unverifiable code signatures. Often tied to Gatekeeper bypasses, App Translocation, or use of unsigned launch daemons by untrusted users.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:endpointsecurity	ES_EVENT_TYPE_NOTIFY_EXEC
File MetadataDC0059	macos:unifiedlog	subsystem:syspolicyd
File ModificationDC0061	fs:fileevents	/var/log/install.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CodeSigningStatus	Filters such as 'Unsigned', 'NotTrusted', or 'ModifiedSinceSigning' may vary by policy enforcement level
UserContext	Tune whether detection applies to all users or excludes trusted admin accounts
ExecutablePathPrefix	Enable tuning for known valid locations (e.g., /Applications) vs. suspicious paths (/Users/Shared)

Invalid Code Signature detections T1036.001

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs