Masquerading: Invalid Code Signature

Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving monitoring and security tools and users. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program. Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may and therefore improperly handled.[1][2]

Procedure Examples

Name Description
BADNEWS

BADNEWS is sometimes signed with an invalid Authenticode certificate in an apparent effort to make it look more legitimate.[3]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

Collect and analyze signing certificate metadata and check signature validity on software that executes within the environment, look for invalid signatures as well as unusual certificate characteristics and outliers.

References

Attachments

ID
VT0015.001
Sub-techniques
Tactic
Defense Evasion
Platforms
Windows
macOS
Data Sources
Binary file metadata
File monitoring
Process monitoring
Version
1.0

Created: 21 December 2020

Last Modified: 27 December 2020