Code Signing Certificates
Subtechnique · ATTACK:enterprise:T1587.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1587.002",
"title": "Code Signing Certificates",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1587/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--34b3f738-bd64-40e5-a112-29b0542bc8bf",
"external_id": "T1587.002",
"domain": "enterprise",
"created": "2020-10-01T01:41:08.652Z",
"modified": "2025-10-24T17:48:37.738Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"resource-development"
],
"source_references": [
{
"source_name": "Wikipedia Code Signing",
"url": "https://en.wikipedia.org/wiki/Code_signing"
}
]
}Explicit source assertions (6)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1056 → mitigates → ATTACK:enterprise:T1587.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--15cae685-cd89-4b79-b89b-e7153fb16ba2
ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1587.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1db7023d-eab0-4ddb-9156-9ac03b5e0db9
ESET EvasivePanda 2024ATTACK:enterprise:G0056 → uses → ATTACK:enterprise:T1587.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4ac5b593-8f47-46cc-9af3-fcb0eb20f66e
Bitdefender StrongPity June 2020ATTACK:enterprise:T1587.002 → subtechnique-of → ATTACK:enterprise:T1587
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f2ee424-4550-48ac-b995-2cdae87f45f9
ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1587.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9319fb2f-88df-4195-a42e-2a6a983a4840
Unit 42 BackConfig May 2020ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1587.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96ff6190-cb11-4473-a194-abbf317205b8
ESET Lazarus Jun 2020