diff --git a/red-teaming/Self-Signed Threat/README.md b/red-teaming/Self-Signed Threat/README.md index f817546..70303a0 100644 --- a/red-teaming/Self-Signed Threat/README.md +++ b/red-teaming/Self-Signed Threat/README.md @@ -3,8 +3,11 @@ A Powershell script that signs input Executable file with fake Microsoft code-signing certificate to demonstrate risks of Code Signing attacks. Script was shamelessly borrowed from [Matt Graeber, @mattifestation](https://twitter.com/mattifestation) and his research titled [_Code Signing Certificate Cloning Attacks and Defenses_](https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec) + **All credits go to Matt** - I merely copied it preserverance purposes. +### Effectiveness + As of 13/07/2022 this **dumb trick** still gets off the shelf malware evade detection of at least 8 modern security scanners. | What | Result |