T1553.002Defense Impairment
Code Signing
Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. The certificates used during an operation may be created, acquired, or stolen by the adversary. Unlike Invalid Code Signature, this activity will result in a valid…
CVEs5
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.5
Reports1
Detections
1 Sigma rule tagged T1553.002Code SigningT1553.0021 general rule
- Potential Secure Deletion with SDeletemediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Code Signing
5 CVEs, by priority. Each link shows its badge.- CVE-2013-3900Microsoft WinVerifyTrust function Remote Code ExecutionMicrosoft · WinVerifyTrust functionKEVPublic exploitMedium · 5.5T1204.002Malicious FileT1553.002Code Signing1 reportAI mapping from the description · primary impact44.6%Top 1.2%80.5priority
- CVE-2020-0601Microsoft Windows CryptoAPI Spoofing VulnerabilityAI mapping from the description · how it is exploited89.1%Top 0.22%78.6priority
- CVE-2026-8398Daemon Tools Lite Embedded Malicious Code VulnerabilityDaemon · Daemon Tools LiteKEVPublic exploitCritical · 9.8T1195.002Compromise Software Supply ChainT1553.002Code SigningAI mapping from the description · primary impact1.5%Top 27%69.6priority
- CVE-2023-41991Apple Multiple Products Improper Certificate Validation VulnerabilityAI mapping from the description · primary impact13.4%Top 3.6%66.1priority
- CVE-2012-0151Microsoft Windows Authenticode Signature Verification Remote Code Execution VulnerabilityAI mapping from the description · primary impact87.7%Top 0.24%63.4priority