{"description": "ICS techniques mitigated by Code Signing, ATT&CK mitigation M0945 (v1.0)", "name": "Code Signing (M0945)", "domain": "ics-attack", "versions": {"layer": "4.5", "attack": "17", "navigator": "5.1.0"}, "techniques": [{"techniqueID": "T0849", "comment": "Require signed binaries.\n", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T0821", "comment": "Utilize code signatures to verify the integrity and authenticity of programs installed on safety or control assets, including the associated controller tasking.\n", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T0889", "comment": "Utilize code signatures to verify the integrity and authenticity of programs installed on safety or control assets.\n", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T0839", "comment": "Devices should verify that firmware has been properly signed by the vendor before allowing installation.\n", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T0843", "comment": "Utilize code signatures to verify the integrity and authenticity of programs downloaded to the device.\n", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T0873", "comment": "Allow for code signing of any project files stored at rest to prevent unauthorized tampering. Ensure the signing keys are not easily accessible on the same system.\n", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T0851", "comment": "Digital signatures may be used to ensure application DLLs are authentic prior to execution.\n", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T0862", "comment": "When available utilize hardware and software root-of-trust to verify the authenticity of a system. This may be achieved through cryptographic means, such as digital signatures or hashes, of critical software and firmware throughout the supply chain.\n", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T0857", "comment": "Devices should verify that firmware has been properly signed by the vendor before allowing installation.\n", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T0863", "comment": "Prevent the use of unsigned executables, such as installers and scripts.\n", "score": 1, "color": "#66b1ff", "showSubtechniques": false}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "mitigated by Code Signing", "color": "#66b1ff"}]}