Obtain Capabilities: Code Signing Certificates (T1588.003) is a resource development technique tagged PRE. The adversary buys or steals certificates that sign code.
How attackers use it
MITRE explains that code signing confirms the author and that code has not changed. Users and security tools may trust signed code more than unsigned code even if they do not know who issued the certificate or wrote the code.
Adversaries may buy certificates, using a front organization or information stolen from a compromised entity to pass the certificate provider's validation. They may also steal code signing material directly from a compromised third party.
For software vendors, that is the risk. Your signing key is a trust badge that can be used on someone else's code.
How to detect it
MITRE suggests analyzing code signing certificates for features that may link them to the adversary, such as thumbprint, algorithm, validity period, common name and certificate authority. Malware repositories can help find other samples that share patterns in how the certificates were procured.
It says much of the activity is outside your visibility and points to follow-on behavior such as code signing and installing a root certificate.
If you sign software, watch the certificate authority and your own key usage logs. Signatures made by your key that you did not request are the sign of theft.
Click through it at your own pace, or open it full screen.
How to reduce the risk
MITRE lists Pre-compromise as the mitigation. For code signing owners, these are general practices.
- Store signing keys in hardware security modules or managed key services, not on build servers or laptops.
- Limit who and what can request a signature, and log every request.
- Sign only builds that come from a controlled pipeline, and record where each signed build came from.
- Be ready to revoke a certificate quickly and tell customers.
- For software you consume, verify signatures and provenance, and do not treat a valid signature alone as proof of safety.
Check your own environment
- Where are your signing keys held, and who can use them?
- Can you list every signature made with each key in the last 90 days, and match each to a known build?
- Do you have a revocation plan?
- Windows, PowerShell, read-only:
Get-AuthenticodeSignature .\file.exe | Format-List *shows signer and certificate details for a file.
Quick check
How might an adversary buy a code signing certificate?
Using a front organization or stolen information from a compromised entity to pass the provider's validation.
What is the best sign of key theft for a software publisher?
Signatures made with your key that you did not request and cannot match to a known build.
