T1036.001 Invalid Code Signature
sub-techniqueEnterpriseAdversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program. Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files. Unlike Code Signing, this activity will not result in a valid signature.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-technique of
The broader entity this sits under.
mitigations
ATT&CK mitigations that reduce this.
detected by (4)
Data components that detect this.
countered by (D3FEND)
D3FEND countermeasures that counter this.
Detect
Isolate
Deceive
Restore
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- DE.CMContinuous Monitoringstrong · backed by 3 of 5 mapped controls
- PR.PSPlatform Securitystrong · backed by 3 of 5 mapped controls
- ID.RARisk Assessmentmoderate · backed by 2 of 5 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (5)
Security controls that mitigate this.
attack patterns (1)
CAPEC attack patterns that exploit this.
groups (3)
Threat groups associated with this.
software (8)
Malware and tools associated with this.
campaigns (1)
Campaigns that use this.
source
Where this definition is published.