T1553.002: Code Signing — MITRE ATT&CK Technique

Description

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) The certificates used during an operation may be created, acquired, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates) Unlike Invalid Code Signature, this activity will result in a valid signature.

Code signing to verify software on first run can be used on modern Windows and macOS systems. It is not used on Linux due to the decentralized nature of the platform. (Citation: Wikipedia Code Signing)(Citation: EclecticLightChecksonEXECodeSigning)

Code signing certificates may be used to bypass security policies that require signed code to execute on a system.

Platforms

macOSWindows

Threat Groups (28)

ID	Group	Context
G0093	GALLIUM	[GALLIUM](https://attack.mitre.org/groups/G0093) has used stolen certificates to sign its tools including those from Whizzimo LLC.(Citation: Microsoft...
G0094	Kimsuky	[Kimsuky](https://attack.mitre.org/groups/G0094) has signed files with the name EGIS CO,. Ltd. and has stolen a valid certificate that is used to sign...
G0040	Patchwork	[Patchwork](https://attack.mitre.org/groups/G0040) has signed malware with self-signed certificates from fictitious and spoofed legitimate software co...
G0096	APT41	[APT41](https://attack.mitre.org/groups/G0096) leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizat...
G0045	menuPass	[menuPass](https://attack.mitre.org/groups/G0045) has resized and added data to the certificate table to enable the signing of modified files with leg...
G0037	FIN6	[FIN6](https://attack.mitre.org/groups/G0037) has used Comodo code-signing certificates.(Citation: Security Intelligence More Eggs Aug 2019)
G0046	FIN7	[FIN7](https://attack.mitre.org/groups/G0046) has signed [Carbanak](https://attack.mitre.org/software/S0030) payloads with legally purchased code sign...
G0129	Mustang Panda	[Mustang Panda](https://attack.mitre.org/groups/G0129) has used valid legitimate digital signatures and certificates to evade detection.(Citation: CSI...
G1015	Scattered Spider	[Scattered Spider](https://attack.mitre.org/groups/G1015) has used self-signed and stolen certificates originally issued to NVIDIA and Global Software...
G1009	Moses Staff	[Moses Staff](https://attack.mitre.org/groups/G1009) has used signed drivers from an open source tool called DiskCryptor to evade detection.(Citation:...
G0049	OilRig	[OilRig](https://attack.mitre.org/groups/G0049) has signed its malware with stolen certificates.(Citation: ClearSky OilRig Jan 2017)
G0039	Suckfly	[Suckfly](https://attack.mitre.org/groups/G0039) has used stolen certificates to sign its malware.(Citation: Symantec Suckfly March 2016)
G1031	Saint Bear	[Saint Bear](https://attack.mitre.org/groups/G1031) has used an initial loader malware featuring a legitimate code signing certificate associated with...
G0065	Leviathan	[Leviathan](https://attack.mitre.org/groups/G0065) has used stolen code signing certificates to sign malware.(Citation: FireEye Periscope March 2018)(...
G0092	TA505	[TA505](https://attack.mitre.org/groups/G0092) has signed payloads with code signing certificates from Thawte and Sectigo.(Citation: Cybereason TA505 ...
G1054	MirrorFace	[MirrorFace](https://attack.mitre.org/groups/G1054) has abused a known Microsoft digital signature verification issues to append encrypted data to dig...
G1051	Medusa Group	[Medusa Group](https://attack.mitre.org/groups/G1051) has utilized vulnerable or signed drivers to kill or delete services associated with endpoint de...
G0012	Darkhotel	[Darkhotel](https://attack.mitre.org/groups/G0012) has used code-signing certificates on its malware that are either forged due to weak keys or stolen...
G1014	LuminousMoth	[LuminousMoth](https://attack.mitre.org/groups/G1014) has signed their malware with a valid digital signature.(Citation: Kaspersky LuminousMoth July 2...
G0044	Winnti Group	[Winnti Group](https://attack.mitre.org/groups/G0044) used stolen certificates to sign its malware.(Citation: Kaspersky Winnti April 2013)

Associated Software (53)

ID	Name	Type	Context
S0266	TrickBot	Malware	[TrickBot](https://attack.mitre.org/software/S0266) has come with a signed downloader component.(Citation: Cyberreason Anchor December 2019)
S0520	BLINDINGCAN	Malware	[BLINDINGCAN](https://attack.mitre.org/software/S0520) has been signed with code-signing certificates such as CodeRipper.(Citation: US-CERT BLINDINGCA...
S0603	Stuxnet	Malware	[Stuxnet](https://attack.mitre.org/software/S0603) used a digitally signed driver with a compromised Realtek certificate.(Citation: Nicolas Falliere, ...
S1233	PAKLOG	Malware	[PAKLOG](https://attack.mitre.org/software/S1233) has used legitimate signed binaries such as PACLOUD.exe for follow-on execution of malicious DLLs th...
S0491	StrongPity	Malware	[StrongPity](https://attack.mitre.org/software/S0491) has been signed with self-signed certificates.(Citation: Bitdefender StrongPity June 2020)
S0163	Janicab	Malware	[Janicab](https://attack.mitre.org/software/S0163) used a valid AppleDeveloperID to sign the code to get past security restrictions.(Citation: Janicab...
S1239	TONESHELL	Malware	[TONESHELL](https://attack.mitre.org/software/S1239) has used valid legitimate digital signatures and certificates to evade detection.(Citation: CSIRT...
S0624	Ecipekac	Malware	[Ecipekac](https://attack.mitre.org/software/S0624) has used a valid, legitimate digital signature to evade detection.(Citation: Securelist APT10 Marc...
S1226	BOOKWORM	Malware	[BOOKWORM](https://attack.mitre.org/software/S1226) has used valid legitimate digital signatures and certificates to evade detection. (Citation: Unit4...
S1238	STATICPLUGIN	Malware	[STATICPLUGIN](https://attack.mitre.org/software/S1238) has been signed with a valid Certificate Authority(CA) to circumvent endpoint defenses.(Citati...
S0342	GreyEnergy	Malware	[GreyEnergy](https://attack.mitre.org/software/S0342) digitally signs the malware with a code-signing certificate.(Citation: ESET GreyEnergy Oct 2018)
S1228	PUBLOAD	Malware	[PUBLOAD](https://attack.mitre.org/software/S1228) has used valid legitimate digital signatures and certificates to evade detection.(Citation: CSIRT C...
S1149	CHIMNEYSWEEP	Malware	[CHIMNEYSWEEP](https://attack.mitre.org/software/S1149) has been dropped by a self-extracting archive signed with a valid digital certificate.(Citatio...
S0415	BOOSTWRITE	Malware	[BOOSTWRITE](https://attack.mitre.org/software/S0415) has been signed by a valid CA.(Citation: FireEye FIN7 Oct 2019)
S0646	SpicyOmelette	Malware	[SpicyOmelette](https://attack.mitre.org/software/S0646) has been signed with valid digital certificates.(Citation: Secureworks GOLD KINGSWOOD Septemb...
S0372	LockerGoga	Malware	[LockerGoga](https://attack.mitre.org/software/S0372) has been signed with stolen certificates in order to make it look more legitimate.(Citation: Wir...
S0504	Anchor	Malware	[Anchor](https://attack.mitre.org/software/S0504) has been signed with valid certificates to evade detection by security tools.(Citation: Cyberreason ...
S1232	SplatDropper	Malware	[SplatDropper](https://attack.mitre.org/software/S1232) has used legitimate signed binaries such as BugSplatHD64.exe for follow-on execution of malici...
S1213	Lumma Stealer	Malware	[Lumma Stealer](https://attack.mitre.org/software/S1213) has used valid code signing digital certificates from ConsolHQ LTD and Verandah Green Limited...
S0091	Epic	Malware	[Turla](https://attack.mitre.org/groups/G0010) has used valid digital certificates from Sysprint AG to sign its [Epic](https://attack.mitre.org/softwa...

References

Frequently Asked Questions

What is T1553.002 (Code Signing)?

T1553.002 is a MITRE ATT&CK technique named 'Code Signing'. It belongs to the Defense Impairment tactic(s). Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the b...

How can T1553.002 be detected?

Detection of T1553.002 (Code Signing) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.

What mitigations exist for T1553.002?

Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.

Which threat groups use T1553.002?

Known threat groups using T1553.002 include: GALLIUM, Kimsuky, Patchwork, APT41, menuPass, FIN6, FIN7, Mustang Panda.