TeamPCPG1056 ↗
Has compromised legitimate software release workflows resulting in malicious packages receiving legitimate project cryptographic signing.1
- Tactic
- Defense Impairment
- Platforms
- macOS, Windows
- Version
- 2.0
- Created
- 05 February 2020
- Last modified
- 12 May 2026
Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. [1] The certificates used during an operation may be created, acquired, or stolen by the adversary. [2] [3] Unlike Invalid Code Signature, this activity will result in a valid signature.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
28
Threat groupsTop 6%
Threat groups94th percentile · 94% of ATT&CK techniques have this many threat groups attributed or fewer.8
CampaignsTop 5%
Campaigns95th percentile · 95% of ATT&CK techniques have this many campaigns recorded or fewer.53
Tools & malwareTop 7%
Tools & malware93rd percentile · 93% of ATT&CK techniques have this many tools implementing them or fewer.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.Code Signing MITRE reference T1553.002
Top 6%of all ATT&CK techniques for number of groups
28 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
MirrorFaceG1054 ↗
Has abused a known Microsoft digital signature verification issues to append encrypted data to digital signatures that still appear to be validly signed.1
Medusa GroupG1051 ↗
Has utilized vulnerable or signed drivers to kill or delete services associated with endpoint detection and response (EDR) tools.1
DaggerflyG1034 ↗
Has used signed, but not notarized, malicious files for execution in macOS environments.1
Saint BearG1031 ↗
Has used an initial loader malware featuring a legitimate code signing certificate associated with "Electrum Technologies GmbH."1
Scattered SpiderG1015 ↗
Has used self-signed and stolen certificates originally issued to NVIDIA and Global Software LLC.1
All 28 groups for this technique · 6 newest in this preview
8 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
RedDelta Modified PlugX Infection Chain OperationsC0047 ↗
Mustang Panda used legitimate, signed binaries such as inkform.exe or ExcelRepairToolboxLauncher.exe for follow-on execution of malicious DLLs through DLL search order hijacking in RedDelta Modified PlugX Infection Chain Operations.1
APT41 DUSTC0040 ↗
Used stolen code signing certificates for DUSTTRAP malware and subsequent payloads.1
3CX Supply Chain AttackC0057 ↗
Although the X_TRADER platform was reportedly discontinued in 2020, it was still available for download from the legitimate Trading Technologies website in 2022. During the 3CX Supply Chain Attack, AppleJeus used a code signing certificate to digitally sign the malicious software with an expiration date set to October 2022. This file was signed with the subject “Trading Technologies International, Inc” and contained the executable file Setup.exe, also signed with the same digital certificate.12
C0015C0015 ↗
For C0015, the threat actors used DLL files that had invalid certificates.1
Operation Dream JobC0022 ↗
During Operation Dream Job, Lazarus Group digitally signed their own malware to evade detection.1
SolarWinds CompromiseC0024 ↗
During the SolarWinds Compromise, APT29 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.1
All 8 campaigns for this technique · 6 newest in this preview
53 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
SPAWNCHIMERAS9024 ↗
Has generated RSA keys against modified files to sign the manifest file, so they appear legitimate.12
RedLine StealerS1240 ↗
Has used both valid certificates and self-signed digital certificates to appear legitimate.1
TONESHELLS1239 ↗
Has used valid legitimate digital signatures and certificates to evade detection.1
STATICPLUGINS1238 ↗
Has been signed with a valid Certificate Authority(CA) to circumvent endpoint defenses.1
CorKLOGS1235 ↗
Has used legitimate signed binaries such as lcommute.exe for follow-on execution of malicious DLLs through DLL side-loading.1
PAKLOGS1233 ↗
Has used legitimate signed binaries such as PACLOUD.exe for follow-on execution of malicious DLLs through DLL Side-Loading.1
All 53 software entries for this technique · 6 newest in this preview
Offense vs defense T1553.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 7Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 0
first rule: 2017 Q2 · 7 of 8 campaigns plotted (Operation AkaiRyū (dated 2004) falls before the 2014 window)Code Signing detection strategy DET0230
MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Suspicious or Malicious Code Signing Abuse
2 platforms
AN0643 · Windows
Detects execution of binaries signed with unusual or recently issued certificates, correlation of process execution with abnormal publisher metadata, and mismatched certificate chains. Monitors for revoked or unknown code signing certificates used in high-privilege contexts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AllowedCertificateAuthorities | Define trusted issuers to suppress noise from legitimate enterprise signing chains |
| TimeWindow | Correlation window for detecting execution of binaries with newly observed or anomalous certificates |
| CertificateAgeThreshold | Baseline normal age of certificates; flag very recent or expired certificates |
AN0644 · macOS
Monitors Gatekeeper, spctl, and unified log entries for binaries executed with unexpected or untrusted signatures. Correlates file metadata changes with process launches where signature validation is skipped, altered, or fails but the process still executes.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | Execution of binaries with unsigned or anomalously signed certificates |
| File MetadataDC0059 | macos:unifiedlog | Code signing verification failures or bypassed trust decisions |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DeveloperIDAllowList | Maintain list of expected Developer IDs to minimize false positives from enterprise apps |
| TimeWindow | Correlates file signature changes with subsequent executions |