T1553.002: Code Signing
Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. CitationWikipedia Code Signing The certificates used during an operation may be created, acquired, or stolen by the adversary. CitationSecurelist Digital Certificates CitationSymantec Digital Certificates Unlike Invalid Code Signature, this activity will result in a valid signature.
Code signing to verify software on first run can be used on modern Windows and macOS systems. It is not used on Linux due to the decentralized nature of the platform. CitationWikipedia Code SigningCitationEclecticLightChecksonEXECodeSigning
Code signing certificates may be used to bypass security policies that require signed code to execute on a system.
Security context for executives and security teams
Code Signing matters because it attacks a basic trust decision: Windows and macOS may treat signed software as more trustworthy, but adversaries can create, acquire, or steal signing materials so malware or tools carry a valid signature. For leaders, the risk is not simply “malware is signed”; it is that signed-code controls, user prompts, allowlists, and incident triage assumptions can be weakened if the organization cannot distinguish expected signed software from suspicious signed binaries.
Executive priority
Prioritize this where signed-code execution, software trust, or third-party software updates are important to business continuity. Executives should ask whether code signing certificates and private keys are inventoried and protected, whether endpoint and SOC teams can investigate valid-but-unexpected signatures, and whether incident response plans cover certificate abuse, revocation decisions, and software trust exceptions. The relationships to multiple campaigns and groups, including supply-chain-related campaigns, show this behavior is broadly relevant, but local exposure depends on the organization’s Windows/macOS estate and signing governance.
Technical view
This is a defense-impairment sub-technique of Subvert Trust Controls for macOS and Windows. MITRE does not provide native detection text for this object, but a related detection strategy is listed: DET0230, Detect Suspicious or Malicious Code Signing Abuse. SOC and detection teams should validate whether they can inspect signed binaries beyond a simple valid/invalid result: signer identity, certificate metadata, file hash, path, first-seen time, parent process, and whether the signer is expected for that software. IR teams should treat a valid signature as one data point, not proof of legitimacy.
Likely telemetry
- Endpoint file and process execution telemetry from Windows and macOS systems
- Code signature status and certificate metadata, including signer, issuer, serial number, and signing timestamp where available
- Binary hash, file path, creation/modification time, and first-seen observations
- Software inventory or allowlist records showing expected publishers and approved signed applications
- Code signing certificate inventory and key custody records for internally signed software
Detection direction
- Validate detections for validly signed binaries that are unexpected for the host, user, path, publisher, or business application context.
- Tune logic to avoid trusting signatures alone; compare signature metadata with known-good software inventory and approved certificate usage.
- Look for newly observed signed binaries, unusual signer reuse, or signed tools appearing in suspicious execution chains.
- Account for false positives from legitimate software updates, developer tools, and internally signed applications by maintaining certificate and publisher baselines.
- Use the DET0230 relationship as the ATT&CK-linked detection direction, while recognizing the technique object itself provides no official detection procedure.
Mitigation priorities
- Inventory and govern code signing certificates and signing keys, especially for internally developed software.
- Restrict and monitor access to code signing materials; ensure custody and approval processes are auditable.
- Define endpoint policy so signed code is not automatically trusted without publisher, path, and business-context validation.
- Maintain approved software and publisher baselines for Windows and macOS to support SOC triage.
- Prepare incident response procedures for suspected certificate compromise or misuse, including containment, revocation decision paths, and replacement of trusted software artifacts.
Additional notes and limits
The material decision point is whether the organization can prove that a signed binary is expected, not merely that the signature is cryptographically valid. This technique has many listed campaign and group relationships, indicating repeated relevance across different intrusion contexts, but those relationships should guide prioritization and hypothesis generation rather than be treated as evidence of current activity in any specific environment.
MITRE provides no official detection text for this technique, and the supplied data does not include specific event IDs, vendor controls, or guaranteed analytics. Coverage must be validated locally against actual Windows/macOS telemetry, certificate governance records, software inventory quality, and endpoint policy behavior.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Code Signing
Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. CitationWikipedia Code Signing The certificates used during an operation may be created, acquired, or stolen by the adversary. CitationSecurelist Digital Certificates CitationSymantec Digital Certificates Unlike Invalid Code Signature, this activity will result in a valid signature.
Code signing to verify software on first run can be used on modern Windows and macOS systems. It is not used on Linux due to the decentralized nature of the platform. CitationWikipedia Code SigningCitationEclecticLightChecksonEXECodeSigning
Code signing certificates may be used to bypass security policies that require signed code to execute on a system.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.