T1553.002 — Code Signing

Tactic: Defense Impairment · Platforms: macOS, Windows

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. The certificates used during an operation may be created,…

Sub-technique of Subvert Trust Controls (T1553).

Sigma detection rules (2)

T1553.002 Subvert Trust Controls: Code Signing

title: "T1553.002 Subvert Trust Controls: Code Signing"
id: b6bb6989-83b8-420e-9c39-56aa046cf44c
description: 'Detect Suspicious or Malicious Code Signing Abuse. (Retargeted from the original process_creation label to image_load — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: AllowedCertificateAuthorities, TimeWindow, CertificateAgeThreshold.'
references:
  - https://attack.mitre.org/techniques/T1553/002
author: Shahrukh Khan
date: 2026-01-24
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1553.002

logsource:
  category: image_load
  product: windows
  service: sysmon

detection:
  selection:
    Signed: 'true'
    SignatureStatus: 'Valid'
    ImageLoaded|endswith: '.dll'
  selection_temp:
    ImageLoaded|contains: '\AppData\Local\Temp\'

  condition: selection and selection_temp

falsepositives:
  - Legitimate signed third-party installers/updaters occasionally stage DLLs in a Temp directory before relocating them; this rule still needs scoping to security-sensitive processes (browsers, lsass, admin tools) for high-confidence alerting.

level: medium

T1553.002 Subvert Trust Controls: Code Signing

title: "T1553.002 Subvert Trust Controls: Code Signing"
id: 584b2e1f-46ae-4dab-92cb-aa20e3e5b10f
description: 'Detect Suspicious or Malicious Code Signing Abuse. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: DeveloperIDAllowList, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1553/002
author: Shahrukh Khan
date: 2026-02-16
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1553.002

logsource:
  product: macos

detection:
  selection:
    Image|endswith: '/codesign'
  selection_args:
    CommandLine|contains:
      - '--force'
      - '--deep'
      - '-s -'
  condition: selection and selection_args

falsepositives:
  - Developers legitimately ad-hoc re-sign their own binaries with codesign during local build and test cycles, so this should be scoped to re-signing of system binaries or third party applications outside a developer environment.

level: high

Related sub-techniques

Explore