H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Code Signing

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) The certificates used during an operation may be created, acquired, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates) Unlike [Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001), this activity will result in a valid signature. Code signing to verify software on first run can be used on modern Windows and macOS systems. It is not used on Linux due to the decentralized nature of the platform. (Citation: Wikipedia Code Signing)(Citation: EclecticLightChecksonEXECodeSigning) Code signing certificates may be used to bypass security policies that require signed code to execute on a system.

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) The certificates used during an operation may be created, acquired, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates) Unlike [Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001), this activity will result in a valid signature. Code signing to verify software on first run can be used on modern Windows and macOS systems. It is not used on Linux due to the decentralized nature of the platform. (Citation: Wikipedia Code Signing)(Citation: EclecticLightChecksonEXECodeSigning) Code signing certificates may be used to bypass security policies that require signed code to execute on a system.

94 recorded

Relationships

mapped-to
from Signature Spoof
Technique
mapped-to
from Signing Malicious Code
Technique
mapped-to
from Subvert Code-signing Facilities
Technique
revoked-by
from Code Signing
Technique
subtechnique-of
to Subvert Trust Controls
Technique
uses
from 3CX Supply Chain Attack
Campaign
uses
from Anchor
Malware
uses
from AppleJeus
Malware
uses
from APT41
Group
uses
from APT41 DUST
Campaign
uses
from BackConfig
Malware
uses
from Bandook
Malware
uses
from Bazar
Malware
uses
from Black Basta
Malware
uses
from BLINDINGCAN
Malware
uses
from BOOKWORM
Malware
uses
from BOOSTWRITE
Malware
uses
from C0015
Campaign
uses
from ChChes
Malware
uses
from CHIMNEYSWEEP
Malware
uses
from Clop
Malware
uses
from Cobalt Strike
Malware
uses
from CopyKittens
Group
uses
from CorKLOG
Malware
uses
from CSPY Downloader
Tool
uses
from Daggerfly
Group
uses
from Darkhotel
Group
uses
from Daserf
Malware
uses
from Ebury
Malware
uses
from Ecipekac
Malware
uses
from Epic
Malware
uses
from FIN6
Group
uses
from FIN7
Group
uses
from GALLIUM
Group
uses
from Gazer
Malware
uses
from GoBear
Malware
uses
from GreyEnergy
Malware
uses
from Helminth
Malware
uses
from HermeticWiper
Malware
uses
from HermeticWizard
Malware
uses
from Janicab
Malware
uses
from Kimsuky
Group
uses
from Lazarus Group
Group
uses
from Leviathan
Group
uses
from LockerGoga
Malware
uses
from LuminousMoth
Group
uses
from Lumma Stealer
Malware
uses
from MacMa
Malware
uses
from Medusa Group
Group
uses
from menuPass
Group
uses
from Metamorfo
Malware
uses
from MirrorFace
Group
uses
from Molerats
Group
uses
from More_eggs
Malware
uses
from Moses Staff
Group
uses
from Mustang Panda
Group
uses
from Nerex
Malware
uses
from OilRig
Group
uses
from Operation AkaiRyū
Campaign
uses
from Operation Dream Job
Campaign
uses
from Operation Honeybee
Campaign
uses
from PAKLOG
Malware
uses
from Patchwork
Group
uses
from PipeMon
Malware
uses
from PROMETHIUM
Group
uses
from PUBLOAD
Malware
uses
from QakBot
Malware
uses
from QuasarRAT
Tool
uses
from RedDelta Modified PlugX Infection Chain Operations
Campaign
uses
from RedLine Stealer
Malware
uses
from ROADSWEEP
Malware
uses
from RTM
Malware
uses
from Saint Bear
Group
uses
from Scattered Spider
Group
uses
from Silence
Group
uses
from SolarWinds Compromise
Campaign
uses
from SPAWNCHIMERA
Malware
uses
from SpicyOmelette
Malware
uses
from SplatDropper
Malware
uses
from STATICPLUGIN
Malware
uses
from StrelaStealer
Malware
uses
from StrongPity
Malware
uses
from Stuxnet
Malware
uses
from Suckfly
Group
uses
from SUNBURST
Malware
uses
from SysUpdate
Malware
uses
from TA505
Group
uses
from TeamPCP
Group
uses
from TONESHELL
Malware
uses
from TrickBot
Malware
uses
from Troll Stealer
Malware
uses
from Winnti Group
Group
uses
from Wizard Spider
Group
uses
from ZeroCleare
Malware
5 external

References

mitre-attack
T1553.002
open
EclecticLightChecksonEXECodeSigning
https://eclecticlight.co/2020/11/16/checks-on-executable-code-in-catalina-and-big-sur-a-first-draft/
open
Securelist Digital Certificates
https://securelist.com/why-you-shouldnt-completely-trust-files-signed-with-digital-certificates/68593/
open
Symantec Digital Certificates
http://www.symantec.com/connect/blogs/how-attackers-steal-private-keys-digital-certificates
open
Wikipedia Code Signing
https://en.wikipedia.org/wiki/Code_signing
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance