MITRE ATT&CK technique · defense-impairment

`T1553.002` Code Signing

Sub-technique of T1553 Subvert Trust Controls

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) The certificates used during an operation may be created, acquired, or stolen by the adversary. (Citation: Securelist Digital…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

Clop
TeamPCP

Sigma rules to hunt it

Potential Secure Deletion with SDeletemediumtest · windows

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.