Skip to content

Code Signing Policy Modification

Subtechnique · ATTACK:mobile:T1632.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1632.001",
  "title": "Code Signing Policy Modification",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1632/001",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--fcb11f06-ce0e-490b-bcc1-04a1623579f0",
  "external_id": "T1632.001",
  "domain": "mobile",
  "created": "2022-03-30T18:13:26.003Z",
  "modified": "2025-10-24T17:49:39.422Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "defense-evasion"
  ],
  "source_references": [
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/stack-threats/STA-7.html",
      "external_id": "STA-7"
    }
  ]
}

Explicit source assertions (13)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:T1632.001 → subtechnique-of → ATTACK:mobile:T1632

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07fd2c39-c3e2-4044-b00b-71250cd7df2e

ATTACK:mobile:S1056 → uses → ATTACK:mobile:T1632.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ae94053-1963-45ba-a3a9-62e508281c8e

trendmicro_tianyspy_0122

ATTACK:mobile:S0551 → uses → ATTACK:mobile:T1632.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f949bc5-9f6a-4ec8-a29a-87e309aa08a2

Lookout Uyghur Campaign

ATTACK:mobile:M1012 → mitigates → ATTACK:mobile:T1632.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2793d721-df10-4621-8387-f3342def59a1

ATTACK:mobile:S0549 → uses → ATTACK:mobile:T1632.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e3a5d0d-a80a-4606-8be2-208302e995d1

Lookout Uyghur Campaign

ATTACK:mobile:M1006 → mitigates → ATTACK:mobile:T1632.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31330d32-50c8-4499-91fb-e1dcffa9ea8f

Symantec-iOSProfile2 · Android-TrustedCA

ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1632.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c0105f3-e919-499d-b080-d127394d2837

ATTACK:mobile:S0420 → uses → ATTACK:mobile:T1632.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--947e2398-4565-4ae0-8cc2-fb0ef5f9c73f

SecureList DVMap June 2017

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1632.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--99b4be95-74f2-48f7-b4e9-8b4d88ecd31f

Lookout Desert Scorpion

ATTACK:mobile:S0311 → uses → ATTACK:mobile:T1632.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a563fc97-a452-4348-a831-f4fb55c71e35

paloalto_yispecter_1015

ATTACK:mobile:S0490 → uses → ATTACK:mobile:T1632.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b110d919-acd4-4fe0-a46a-ac4819508667

TrendMicro-XLoader-FakeSpy

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1632.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b49ecb71-92b3-4813-be4d-9f8c2aa67ccd

BlackBerry Bahamut

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1632.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd1e016a-1ebb-4f30-9342-998f656dd8b8

Bitdefender Mandrake

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.