Code Signing
Techniques Addressed by Mitigation |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1059 | Command and Scripting Interpreter |
Where possible, only permit execution of signed scripts. |
|
| T1059.001 | PowerShell |
Set PowerShell execution policy to execute only signed scripts. |
||
| T1059.002 | AppleScript |
Require that all AppleScript be signed by a trusted developer ID before being executed - this will prevent random AppleScript code from executing.(Citation: applescript signing) This subjects AppleScript code to the same scrutiny as other .app files passing through Gatekeeper. |
||
| Enterprise | T1554 | Compromise Host Software Binary |
Ensure all application component binaries are signed by the correct application developers. |
|
| Enterprise | T1543 | Create or Modify System Process |
Enforce registration and execution of only legitimately signed service drivers where possible. |
|
| T1543.003 | Windows Service |
Enforce registration and execution of only legitimately signed service drivers where possible. |
||
| Enterprise | T1546 | T1546.006 | Event Triggered Execution: LC_LOAD_DYLIB Addition |
Enforce that all binaries be signed by the correct Apple Developer IDs. |
| T1546.013 | PowerShell Profile |
Enforce execution of only signed PowerShell scripts. Sign profiles to avoid them from being modified. |
||
| Enterprise | T1525 | Implant Internal Image |
Several cloud service providers support content trust models that require container images be signed by trusted sources.(Citation: Content trust in Azure Container Registry)(Citation: Content trust in Docker) |
|
| Enterprise | T1036 | Masquerading |
Require signed binaries. |
|
| T1036.001 | Invalid Code Signature |
Require signed binaries. |
||
| T1036.005 | Match Legitimate Name or Location |
Require signed binaries and images. |
||
| Enterprise | T1601 | Modify System Image |
Many vendors provide digitally signed operating system images to validate the integrity of the software used on their platform. Make use of this feature where possible in order to prevent and/or detect attempts by adversaries to compromise the system image. (Citation: Cisco IOS Software Integrity Assurance - Deploy Signed IOS) |
|
| T1601.001 | Patch System Image |
Many vendors provide digitally signed operating system images to validate the integrity of the software used on their platform. Make use of this feature where possible in order to prevent and/or detect attempts by adversaries to compromise the system image. (Citation: Cisco IOS Software Integrity Assurance - Deploy Signed IOS) |
||
| T1601.002 | Downgrade System Image |
Many vendors provide digitally signed operating system images to validate the integrity of the software used on their platform. Make use of this feature where possible in order to prevent and/or detect attempts by adversaries to compromise the system image. (Citation: Cisco IOS Software Integrity Assurance - Deploy Signed IOS) |
||
| Enterprise | T1505 | Server Software Component |
Ensure all application component binaries are signed by the correct application developers. |
|
| T1505.001 | SQL Stored Procedures |
Ensure all application component binaries are signed by the correct application developers. |
||
| T1505.002 | Transport Agent |
Ensure all application component binaries are signed by the correct application developers. |
||
| T1505.004 | IIS Components |
Ensure IIS DLLs and binaries are signed by the correct application developers. |
||
| Enterprise | T1127 | T1127.002 | Trusted Developer Utilities Proxy Execution: ClickOnce |
Enforce binary and application integrity with digital signature verification to prevent untrusted code from executing.(Citation: Microsoft Learn ClickOnce and Authenticode) |
| Enterprise | T1204 | T1204.003 | User Execution: Malicious Image |
Utilize a trust model such as Docker Content Trust with digital signatures to ensure runtime verification of the integrity and publisher of specific image tags.(Citation: Content trust in Docker)(Citation: Content trust in Azure Container Registry) |
References
- Docker. (2019, October 10). Content trust in Docker. Retrieved October 16, 2019.
- Microsoft. (2019, September 5). Content trust in Azure Container Registry. Retrieved October 16, 2019.
- Steven Sande. (2013, December 23). AppleScript and Automator gain new features in OS X Mavericks. Retrieved September 21, 2018.
- Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Deploy Signed IOS. Retrieved October 21, 2020.
- Microsoft. (2023, March 9). ClickOnce and Authenticode. Retrieved September 9, 2024.
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.