Self-Signed Code Signing Certificates: Defending Against T1587.002

Develop Capabilities: Code Signing Certificates (T1587.002) is a resource development technique tagged PRE. The adversary creates self-signed code signing certificates.

How attackers use it

MITRE explains that code signing confirms the author and that code has not been altered. Users and security tools may trust signed code more than unsigned code, even if they do not know who issued the certificate or who wrote the code.

Before the code signing step itself, adversaries may develop self-signed certificates for use in operations. The signature gives a program an air of authenticity without a certificate authority having vouched for anyone.

How to detect it

MITRE suggests analyzing self-signed code signing certificates for features that may be tied to the adversary, such as thumbprint, algorithm, validity period and common name. Malware repositories can help find other samples that share patterns in how the certificates were made.

Much of the activity is outside your visibility. MITRE points to follow-on behavior such as code signing and installing a root certificate.

The takeaway is that a signature is a clue, not a verdict. Look at who signed, and whether that signer chains to a trusted authority.

Click through it at your own pace, or open it full screen.

How to reduce the risk

MITRE lists Pre-compromise as the mitigation, as nothing stops someone creating a certificate.

• Trust signatures only when they chain to a trusted authority and the signer is one you expect.
• Alert on additions to the trusted root store.
• Use application control rules that name specific publishers, not any signature.
• For your own software, publish provenance and signing details so that customers can verify what they run.

Check your own environment

• Windows, PowerShell, read-only: Get-AuthenticodeSignature .\file.exe | Format-List * shows signer, status and certificate details.
• Windows, PowerShell, read-only: Get-ChildItem Cert:\LocalMachine\Root | Select Subject,Thumbprint,NotAfter lists trusted roots for comparison with your baseline.
• Do your application control rules trust any valid signature, or specific publishers?

Quick check

Sources

• MITRE ATT&CK T1587.002: Code Signing Certificates