T1553.002 Code Signing

Technique: T1553.002
Tactics: Defense Evasion
Research, 90 days: 2
KEV CVEs mapped: 0
SigmaHQ rules: 1
Elastic, Splunk: 4
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1553/002

MITRE description

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with.(Citation: Wikipedia Code Signing) The certificates used during an operation may be created, acquired, or stolen by the adversary.(Citation: Securelist Digital Certificates)(Citation: Symantec Digital Certificates) Unlike [Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001), this activity will result in a valid signature. Code signing to verify software on first run can be used on modern Windows and macOS systems. It is not used on Linux due to the decentralized nature of the platform.(Citation: Wikipedia Code Signing)(Citation: EclecticLightChecksonEXECodeSigning) Code signing certificates may be used to bypass security policies that require signed code to execute on a system.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-08 Zscaler ThreatLabz: Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware
2026-08-13 Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them

Detection coverage

SigmaHQ community rules

Potential Secure Deletion with SDelete (core)

Elastic and Splunk rules

Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601 - CurveBall) (elastic)
Potential Masquerading as System32 DLL (elastic)
Expired or Revoked Driver Loaded (elastic)
Potential Masquerading as System32 Executable (elastic)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.