Skip to content

M0945 Code Signing

Enforce binary and application integrity with digital signature verification to prevent untrusted code from executing.

Item Value
ID M0945
Version 1.0
Created 11 June 2019
Last Modified 30 March 2023
Navigation Layer View In ATT&CK® Navigator

Techniques Addressed by Mitigation

Domain ID Name Use
ics T0849 Masquerading Require signed binaries.
ics T0821 Modify Controller Tasking Utilize code signatures to verify the integrity of the installed program on safety or control assets has not been changed.
ics T0889 Modify Program Utilize code signatures to verify the integrity of the installed program on safety or control assets has not been changed.
ics T0839 Module Firmware Devices should verify that firmware has been properly signed by the vendor before allowing installation.
ics T0843 Program Download Utilize code signatures to verify the integrity of the installed program on safety or control assets has not been changed.
ics T0873 Project File Infection Allow for code signing of any project files stored at rest to prevent unauthorized tampering. Ensure the signing keys are not easily accessible on the same system.
ics T0851 Rootkit Digital signatures may be used to ensure application DLLs are authentic prior to execution.
ics T0862 Supply Chain Compromise When available utilize hardware and software root-of-trust to verify the authenticity of a system. This may be achieved through cryptographic means, such as digital signatures or hashes, of critical software and firmware throughout the supply chain.
ics T0857 System Firmware Devices should verify that firmware has been properly signed by the vendor before allowing installation.
ics T0863 User Execution Prevent the use of unsigned executables, such as installers and scripts.