Techniques › T1587 › T1587.002
T1587.002 Code Signing Certificates
resource development — PRE · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
0
Sigma rules tagged attack.t1587.002
0
KEV CVEs mapped here
<p>Adversaries may create self-signed code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with. Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is.</p><p>Prior to Code Signing, adversaries may develop self-signed code signing certificates for use in operations.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0833 Detection of Code Signing Certificates v1.0
AN1965 PREConsider analyzing self-signed code signing certificates for features that may be associated with the adversary and/or their developers, such as the thumbprint, algorithm used, validity period, and common name. Malware repositories can also be used to identify additional samples associated with the adversary and identify patterns an adversary has used in crafting self-signed code signing certificates. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related follow-on behavior, such as Code Signing or Install Root Certificate.
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1587.002
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1587) 6
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Florian Roth (Nextron Systems)
· 2021-06-29 (modified 2022-12-25) · logsource: product=windows category=file_event · 2131cfb3-8c12-45e8-8fa0-31f5924e9f07
Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675
Author: Florian Roth (Nextron Systems), Sittikorn S
· 2021-09-10 (modified 2023-06-22) · logsource: product=windows category=file_event · 60c0a111-787a-4e8a-9262-ee485f3ef9d5
Detects file creation patterns noticeable during the exploitation of CVE-2021-40444
Author: Florian Roth (Nextron Systems)
· 2021-09-27 (modified 2022-12-09) · logsource: product=windows category=image_load · 640dc51c-7713-4faa-8a0e-e7c0d9d4654c
Detects DLL hijacking technique used by NOBELIUM in their FoggyWeb backdoor. Which loads a malicious version of the expected "version.dll" dll
Author: Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])
· 2023-01-03 (modified 2024-09-19) · logsource: product=linux category=process_creation · a015e032-146d-4717-8944-7a1884122111
Detects known hacktool execution based on image name.
Author: Florian Roth (Nextron Systems)
· 2018-01-23 (modified 2021-11-27) · logsource: product=linux service=auditd · a39d7fa7-3fbd-4dc2-97e1-d87f546b1bbc
Detects program executions in suspicious non-program folders related to malware or hacking activity
Author: Florian Roth (Nextron Systems)
· 2021-06-18 (modified 2023-02-05) · logsource: product=windows category=process_creation · ff23ffbc-3378-435e-992f-0624dcf93ab4
Detects the execution of the PurpleSharp adversary simulation tool