Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1036.001_invalid-code-signature
Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool.
Passed 19 of 22 test cases with the skill, and 12 of 22 without it.
and 4 more in the full report
7 fixed12 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
In our automated risk summary table, what is the exact finding text associated with the Low severity finding for this sub-technique?
| Checked | Without skill | With skill |
|---|---|---|
| Names the finding as 'Invalid Code Signature technique applicable'. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1036
Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program. Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.
Unlike Code Signing, this activity will not result in a valid signature.
Platforms: Windows, macOS
Identify Attack Surface: Determine if the target environment is susceptible to Invalid Code Signature by examining the target platforms (Windows, macOS).
Assess Existing Defenses: Review whether mitigations for T1036.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 12 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.