T1036.001 Invalid Code Signature

Technique

T1036.001

Tactics

Defense Evasion

Research, 90 days

1

KEV CVEs mapped

0

SigmaHQ rules

0

Elastic, Splunk

17

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1036/001

MITRE description

Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program. Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.(Citation: Threatexpress MetaTwin 2017) Unlike [Code Signing](https://attack.mitre.org/techniques/T1553/002), this activity will not result in a valid signature.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-09-17 ESET: Beware the SparroWock: The backdoor that bites, the commands that catch

Detection coverage

Elastic and Splunk rules

• Suspicious Communication App Child Process (elastic)
• Potential Masquerading as Business App Installer (elastic)
• Potential Masquerading as Communication Apps (elastic)
• Potential Masquerading as System32 DLL (elastic)
• Unsigned DLL Side-Loading from a Suspicious Folder (elastic)
• Untrusted Driver Loaded (elastic)
• Unsigned DLL Loaded by Svchost (elastic)
• Startup Folder Persistence via Unsigned Process (elastic)
• Expired or Revoked Driver Loaded (elastic)
• Suspicious DLL Loaded for Persistence or Privilege Escalation (elastic)
• Image Loaded with Invalid Signature (elastic)
• Potential Masquerading as Browser Process (elastic)
• Potential Masquerading as VLC DLL (elastic)
• Potential Masquerading as System32 Executable (elastic)
• Suspicious Outlook Child Process (elastic)
• Unsigned BITS Service Client Process (elastic)
• Execution of an Unsigned Service (elastic)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.