Invalid Code Signature
Subtechnique · ATTACK:enterprise:T1036.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1036.001",
"title": "Invalid Code Signature",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1036/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--b4b7458f-81f2-4d38-84be-1c5ba0167a52",
"external_id": "T1036.001",
"domain": "enterprise",
"created": "2020-02-10T19:49:46.752Z",
"modified": "2026-09-11T19:55:56.428Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"stealth"
],
"source_references": [
{
"source_name": "Threatexpress MetaTwin 2017",
"url": "https://threatexpress.com/blogs/2017/metatwin-borrowing-microsoft-metadata-and-digital-signatures-to-hide-binaries/"
}
]
}Explicit source assertions (14)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0466 → uses → ATTACK:enterprise:T1036.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c837763-c44c-45cc-8c44-332667481a31
objective-see windtail1 dec 2018ATTACK:enterprise:M1045 → mitigates → ATTACK:enterprise:T1036.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e646993-2414-4382-b709-6c5bc02740e3
ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1036.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--469585eb-231d-4ecb-8fc5-fb4f538c3875
TrendMicro Patchwork Dec 2017ATTACK:enterprise:S0019 → uses → ATTACK:enterprise:T1036.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47109a67-e1af-4f5c-8c58-c1580ff5c6ec
Kaspersky ReginATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1036.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--490cc52d-1f6d-45d2-aa0e-2221264c0de0
Securelist ScarCruft Jun 2016ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1036.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76db164b-3792-497e-857d-80fdfea6ee46
SoučekESET_Gentlemen_Jun2026ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1036.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--893c9a7a-7f2c-4b96-877e-06870d5f989f
SANS Windshift August 2018 · objective-see windtail1 dec 2018ATTACK:enterprise:S1234 → uses → ATTACK:enterprise:T1036.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8ebafdbf-ebc8-4e14-9f4b-b1a0f6e79f3f
Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1036.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--add09428-6eda-4cb2-8817-008038ed4f00
McAfee Netwire Mar 2015ATTACK:enterprise:T1036.001 → subtechnique-of → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--baedd4b3-1fc9-4056-a282-322496a3cceb
ATTACK:enterprise:S1050 → uses → ATTACK:enterprise:T1036.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c845732e-054e-4915-81d2-7c5e36da9eb7
Bitdefender FunnyDream Campaign November 2020ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1036.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d0f5c70f-9989-423f-a460-09473759f13b
AI-Mexico-Govt-BreachATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1036.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc9643aa-7b61-4cb1-b181-3d88c0e9742a
ESET Gelsemium June 2021ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1036.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb103b5c-b65b-4214-8d2d-cd2fc066a146
Intrinsec_Vidar_April2026 · QuorumCyber_Vidar_March2023