Code Signing
Enforce binary and application integrity with digital signature verification to prevent untrusted code from executing.
Techniques Addressed by Mitigation
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1059 | Command and Scripting Interpreter |
Where possible, only permit execution of signed scripts. |
|
| .001 | PowerShell |
Set PowerShell execution policy to execute only signed scripts. |
||
| .002 | AppleScript |
Require that all AppleScript be signed by a trusted developer ID before being executed - this will prevent random AppleScript code from executing.[1] This subjects AppleScript code to the same scrutiny as other .app files passing through Gatekeeper. |
||
| Enterprise | T1554 | Compromise Client Software Binary |
Ensure all application component binaries are signed by the correct application developers. |
|
| Enterprise | T1543 | Create or Modify System Process |
Enforce registration and execution of only legitimately signed service drivers where possible. |
|
| .003 | Windows Service |
Enforce registration and execution of only legitimately signed service drivers where possible. |
||
| Enterprise | T1546 | .006 | Event Triggered Execution: LC_LOAD_DYLIB Addition |
Enforce that all binaries be signed by the correct Apple Developer IDs. |
| .013 | Event Triggered Execution: PowerShell Profile |
Enforce execution of only signed PowerShell scripts. Sign profiles to avoid them from being modified. |
||
| Enterprise | T1525 | Implant Internal Image |
Several cloud service providers support content trust models that require container images be signed by trusted sources.[2][3] |
|
| Enterprise | T1036 | Masquerading |
Require signed binaries. |
|
| .001 | Invalid Code Signature |
Require signed binaries. |
||
| .005 | Match Legitimate Name or Location |
Require signed binaries and images. |
||
| Enterprise | T1601 | Modify System Image |
Many vendors provide digitally signed operating system images to validate the integrity of the software used on their platform. Make use of this feature where possible in order to prevent and/or detect attempts by adversaries to compromise the system image. [4] |
|
| .001 | Patch System Image |
Many vendors provide digitally signed operating system images to validate the integrity of the software used on their platform. Make use of this feature where possible in order to prevent and/or detect attempts by adversaries to compromise the system image. [4] |
||
| .002 | Downgrade System Image |
Many vendors provide digitally signed operating system images to validate the integrity of the software used on their platform. Make use of this feature where possible in order to prevent and/or detect attempts by adversaries to compromise the system image. [4] |
||
| Enterprise | T1505 | Server Software Component |
Ensure all application component binaries are signed by the correct application developers. |
|
| .001 | SQL Stored Procedures |
Ensure all application component binaries are signed by the correct application developers. |
||
| .002 | Transport Agent |
Ensure all application component binaries are signed by the correct application developers. |
||
| .004 | IIS Components |
Ensure IIS DLLs and binaries are signed by the correct application developers. |
||
| Enterprise | T1204 | .003 | User Execution: Malicious Image |
Utilize a trust model such as Docker Content Trust with digital signatures to ensure runtime verification of the integrity and publisher of specific image tags.[3][2] |