Code Signing
Enforce binary and application integrity with digital signature verification to prevent untrusted code from executing.
Techniques Addressed by Mitigation
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1554 | 主机软件二进制文件妥协 |
Ensure all application component binaries are signed by the correct application developers. |
|
| Enterprise | T1546 | .006 | 事件触发执行: LC_LOAD_DYLIB Addition |
Enforce that all binaries be signed by the correct Apple Developer IDs. |
| .013 | 事件触发执行: PowerShell Profile |
Enforce execution of only signed PowerShell scripts. Sign profiles to avoid them from being modified. |
||
| Enterprise | T1036 | 伪装 |
Require signed binaries. |
|
| .001 | Invalid Code Signature |
Require signed binaries. |
||
| .005 | Match Legitimate Name or Location |
Require signed binaries and images. |
||
| Enterprise | T1601 | 修改系统镜像 |
Many vendors provide digitally signed operating system images to validate the integrity of the software used on their platform. Make use of this feature where possible in order to prevent and/or detect attempts by adversaries to compromise the system image. [1] |
|
| .001 | Patch System Image |
Many vendors provide digitally signed operating system images to validate the integrity of the software used on their platform. Make use of this feature where possible in order to prevent and/or detect attempts by adversaries to compromise the system image. [1] |
||
| .002 | Downgrade System Image |
Many vendors provide digitally signed operating system images to validate the integrity of the software used on their platform. Make use of this feature where possible in order to prevent and/or detect attempts by adversaries to compromise the system image. [1] |
||
| Enterprise | T1543 | 创建或修改系统进程 |
Enforce registration and execution of only legitimately signed service drivers where possible. |
|
| .003 | Windows Service |
Enforce registration and execution of only legitimately signed service drivers where possible. |
||
| Enterprise | T1127 | .002 | 可信开发者工具代理执行: ClickOnce |
Enforce binary and application integrity with digital signature verification to prevent untrusted code from executing.[2] |
| Enterprise | T1059 | 命令与脚本解释器 |
Where possible, only permit execution of signed scripts. |
|
| .001 | PowerShell |
Set PowerShell execution policy to execute only signed scripts. |
||
| .002 | AppleScript |
Require that all AppleScript be signed by a trusted developer ID before being executed - this will prevent random AppleScript code from executing.[3] This subjects AppleScript code to the same scrutiny as other .app files passing through Gatekeeper. |
||
| Enterprise | T1505 | 服务器软件组件 |
Ensure all application component binaries are signed by the correct application developers. |
|
| .001 | SQL Stored Procedures |
Ensure all application component binaries are signed by the correct application developers. |
||
| .002 | Transport Agent |
Ensure all application component binaries are signed by the correct application developers. |
||
| .004 | IIS Components |
Ensure IIS DLLs and binaries are signed by the correct application developers. |
||
| Enterprise | T1525 | 植入内部镜像 |
Several cloud service providers support content trust models that require container images be signed by trusted sources.[4][5] |
|
| Enterprise | T1204 | .003 | 用户执行: Malicious Image |
Utilize a trust model such as Docker Content Trust with digital signatures to ensure runtime verification of the integrity and publisher of specific image tags.[5][4] |
References
- Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Deploy Signed IOS. Retrieved October 21, 2020.
- Microsoft. (2023, March 9). ClickOnce and Authenticode. Retrieved September 9, 2024.
- Steven Sande. (2013, December 23). AppleScript and Automator gain new features in OS X Mavericks. Retrieved September 21, 2018.