Mustang PandaG0129 ↗
Has used revoked code signing certificates for its malicious payloads.1
tfMITRE ATT&CK sub-technique
Code Signing Certificates T1588.003
sub-technique of T1588 Obtain Capabilities
- Tactic
- Resource Development
- Platform
- PRE
- Version
- 1.1
- Created
- 01 October 2020
- Last modified
- 24 October 2025
Adversaries may buy and/or steal code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.[1] Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
7
Threat groupsTop 23%
Threat groups77th percentile · 77% of ATT&CK techniques have this many threat groups attributed or fewer.3
CampaignsTop 12%
Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Code Signing Certificates MITRE reference T1588.003
Top 23%of all ATT&CK techniques for number of groups
7 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Wizard SpiderG0102 ↗
Has obtained code signing certificates signed by DigiCert, GlobalSign, and COMOOD for malware payloads.12
BlackTechG0098 ↗
Has used stolen code-signing certificates for its malicious payloads.1
KimsukyG0094 ↗
Has stolen a valid certificate that is used to sign the malware and the dropper.1
FIN8G0061 ↗
Has used an expired open-source X.509 certificate for testing in the OpenSSL repository, to connect to actor-controlled C2 servers.1
OilRigG0049 ↗
Has obtained stolen code signing certificates to digitally sign malware.1
All 7 groups for this technique · 6 newest in this preview
3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
APT41 DUSTC0040 ↗
Used stolen code signing certificates to sign DUSTTRAP malware and components.1
HomeLand JusticeC0038 ↗
During HomeLand Justice, threat actors used tools with legitimate code signing certificates. 1
Operation Dream JobC0022 ↗
During Operation Dream Job, Lazarus Group used code signing certificates issued by Sectigo RSA for some of its malware and tools.1
All 3 campaigns for this technique
Offense vs defense T1588.003
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Code Signing Certificates detection strategy DET0875
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Code Signing Certificates
1 platform
AN2007 · PRE
Consider analyzing code signing certificates for features that may be associated with the adversary and/or their developers, such as the thumbprint, algorithm used, validity period, common name, and certificate authority. Malware repositories can also be used to identify additional samples associated with the adversary and identify patterns an adversary has used in procuring code signing certificates. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related follow-on behavior, such as Code Signing or Install Root Certificate.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Malware MetadataDC0003 | Malware Repository | None |
Pre-compromiseM1056
This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.