Abuse Code Signing

An adversary uses code-signing materials with an available private key to sign malicious code so the resulting signature can take advantage of security controls that trust the certificate, issuer, or publisher. A valid signature provides integrity and signer information; it does not establish that code is benign or guarantee application-control, reputation, or antivirus acceptance. This record documents a Windows SignTool example; the ATT&CK sub-technique also covers macOS.