{"description": "Enterprise techniques mitigated by Code Signing, ATT&CK mitigation M1045 (v1.2)", "name": "Code Signing (M1045)", "domain": "enterprise-attack", "versions": {"layer": "4.5", "attack": "19", "navigator": "5.3.2"}, "techniques": [{"techniqueID": "T1059", "comment": "Where possible, only permit execution of signed scripts.", "score": 1, "showSubtechniques": true}, {"techniqueID": "T1059.001", "comment": "Set PowerShell execution policy to execute only signed scripts.", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1059.002", "comment": "Require that all AppleScript be signed by a trusted developer ID before being executed - this will prevent random AppleScript code from executing.(Citation: applescript signing) This subjects AppleScript code to the same scrutiny as other .app files passing through Gatekeeper.", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1554", "comment": "Ensure all application component binaries are signed by the correct application developers.", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1543", "comment": "Enforce registration and execution of only legitimately signed service drivers where possible.", "score": 1, "showSubtechniques": true}, {"techniqueID": "T1543.003", "comment": "Enforce registration and execution of only legitimately signed service drivers where possible.", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1546", "showSubtechniques": true}, {"techniqueID": "T1546.006", "comment": "Enforce that all binaries be signed by the correct Apple Developer IDs.", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1546.013", "comment": "Enforce execution of only signed PowerShell scripts. Sign profiles to avoid them from being modified.", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1525", "comment": "Several cloud service providers support content trust models that require container images be signed by trusted sources.(Citation: Content trust in Azure Container Registry)(Citation: Content trust in Docker)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1036", "comment": "Require signed binaries.", "score": 1, "showSubtechniques": true}, {"techniqueID": "T1036.001", "comment": "Require signed binaries.", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1036.005", "comment": "Require signed binaries and images.", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1601", "comment": "Many vendors provide digitally signed operating system images to validate the integrity of the software used on their platform.  Make use of this feature where possible in order to prevent and/or detect attempts by adversaries to compromise the system image. (Citation: Cisco IOS Software Integrity Assurance - Deploy Signed IOS)", "score": 1, "showSubtechniques": true}, {"techniqueID": "T1601.001", "comment": "Many vendors provide digitally signed operating system images to validate the integrity of the software used on their platform.  Make use of this feature where possible in order to prevent and/or detect attempts by adversaries to compromise the system image. (Citation: Cisco IOS Software Integrity Assurance - Deploy Signed IOS)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1601.002", "comment": "Many vendors provide digitally signed operating system images to validate the integrity of the software used on their platform.  Make use of this feature where possible in order to prevent and/or detect attempts by adversaries to compromise the system image. (Citation: Cisco IOS Software Integrity Assurance - Deploy Signed IOS)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1505", "comment": "Ensure all application component binaries are signed by the correct application developers.", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1505.001", "comment": "Ensure all application component binaries are signed by the correct application developers. ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1505.002", "comment": "Ensure all application component binaries are signed by the correct application developers. ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1505.004", "comment": "Ensure IIS DLLs and binaries are signed by the correct application developers.", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1505.006", "comment": "Enabling the `execInstalledOnly` feature prevents unsigned binaries from being run on ESXi hosts.(Citation: Google Cloud Threat Intelligence ESXi Hardening 2023)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1127", "showSubtechniques": true}, {"techniqueID": "T1127.002", "comment": "Enforce binary and application integrity with digital signature verification to prevent untrusted code from executing.(Citation: Microsoft Learn ClickOnce and Authenticode)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1204", "showSubtechniques": true}, {"techniqueID": "T1204.003", "comment": "Utilize a trust model such as Docker Content Trust with digital signatures to ensure runtime verification of the integrity and publisher of specific image tags.(Citation: Content trust in Docker)(Citation: Content trust in Azure Container Registry)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "mitigated by Code Signing", "color": "#66b1ff"}]}