Code signing tells you who built a binary and that nobody changed it afterward. Invalid Code Signature, ATT&CK T1036.001, is the attempt to borrow that trust without earning it. It falls under Stealth and applies to macOS and Windows.
MITRE explains that an adversary can copy the metadata and signature information from a signed program and use it as a template for an unsigned program. The result will not pass a signature check, but it can look legitimate to a person or to a tool that handles it carelessly. MITRE is explicit that this differs from the Code Signing technique, because here no valid signature results.
How attackers use it
The goal is to deceive a user, an analyst or a tool by mimicking the look of a valid signature. Some tools only check that signature data is present, not that it validates. Some people see a publisher name in a dialog and stop reading. MITRE's procedure examples include malware signed with invalid certificates that name a well-known company, and malicious DLLs carrying unverified signatures.
How to detect it
MITRE's detection strategy centers on execution of binaries where the metadata claims a signature but validation fails. On Windows, that means looking at signature status in your process and image load telemetry and treating anything other than valid as a lead, especially when the parent process or the execution path is unusual.
On macOS, the analytic points to binaries or applications run with tampered or unverifiable signatures. It also mentions links to Gatekeeper bypasses, App Translocation and unsigned launch daemons used by untrusted users.
Useful fields to keep: signer name, signature status, file hash, path and parent process.
How to reduce the risk
MITRE lists one mitigation: require signed binaries. In practice this means application control that checks that a signature validates, not only that one exists, and a policy that blocks or flags anything unsigned or invalid in the places you care about, such as launch daemons and server software.
You can spot check a file yourself. On Windows PowerShell:
Get-AuthenticodeSignature "C:\path\to\file.exe" | Format-List Status, StatusMessage
On macOS:
codesign --verify --deep --strict --verbose=2 /path/to/App.app
A status of Valid on Windows and a clean exit from codesign on macOS are what you want to see.
