T1036.001 — Invalid Code Signature

Tactic: Stealth · Platforms: macOS, Windows

Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Adversaries can copy the…

Sub-technique of Masquerading (T1036).

Sigma detection rules (2)

T1036.001 Masquerading: Invalid Code Signature

title: "T1036.001 Masquerading: Invalid Code Signature"
id: dc8834a7-4d20-4794-b7cb-439c8e4d73d2
description: 'Detects high-value system binaries loaded with an unsigned/invalid code signature, using the Signed field that only Sysmon ImageLoad telemetry carries. (Retargeted to Sysmon EventID 7 ImageLoad — process_creation does not carry signature/Signed fields.) Tune using: SignatureValidationResult, ParentProcessName, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1036/001
author: Shahrukh Khan
date: 2026-05-24
license: MIT
tags:
  - attack.stealth
  - attack.t1036.001

logsource:
  category: image_load
  product: windows
  service: sysmon

detection:
  selection_image:
    Image|endswith:
      - '\svchost.exe'
      - '\explorer.exe'
      - '\lsass.exe'
      - '\csrss.exe'
      - '\winlogon.exe'
      - '\services.exe'

  selection_unsigned:
    Signed: 'false'

  condition: selection_image and selection_unsigned

falsepositives:
  - Rare — requires Sysmon's <CheckSignature> option enabled for the Signed field to populate reliably; ImageLoad volume is high, so this rule is scoped to the listed high-value binaries only. Confirm signature checking is enabled in the Sysmon config before relying on this rule.

level: high

T1036.001 Masquerading: Invalid Code Signature

title: "T1036.001 Masquerading: Invalid Code Signature"
id: ea06970d-1d51-4011-a75c-346f50d1167c
description: 'Invalid Code Signature Execution Detection via Metadata and Behavioral Context. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CodeSigningStatus, UserContext, ExecutablePathPrefix.'
references:
  - https://attack.mitre.org/techniques/T1036/001
author: Shahrukh Khan
date: 2026-04-16
license: MIT
tags:
  - attack.stealth
  - attack.t1036.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/codesign'
    CommandLine|contains: '--verify'
  selection_spctl:
    Image|endswith: '/spctl'
    CommandLine|contains: 'reject'
  condition: 1 of selection*

falsepositives:
  - Security teams routinely auditing code signatures of third-party applications for compliance checks.

level: high

Related sub-techniques

Explore