Home/ MITRE Matrix/ Defense Evasion/ T1553.002

T1553.002Code Signing

T1553.002 — Code Signing is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 3 detection use cases covering it and 4 threat-intel articles citing it.

Defense Evasion

View on the matrix → Filter Detection Library MITRE official spec ↗

3Use cases

4Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1553 · Subvert Trust Controls

Use cases covering this technique (3)

[LLM] CoolClient signed kernel rootkit msagent.sys dropped and registered as 'msagent' driver service Bespoke install · hunting DSΣPDDCS [LLM] CoolClient signed kernel rootkit: msagent.sys driver service install (Nanjing Ranyi cert) Bespoke install · alerting DSΣPDDCS [LLM] macOS Axios RAT daemon spoof + ad-hoc codesign of hidden /private/tmp binary Bespoke install · alerting DSΣPDDCS

Articles citing this technique (4)

high Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth art-43

crit APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit art-48

crit OceanLotus: From external espionage to domestic targeting art-388

high Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT art-585