macOS Code Signature Invalidation

title: macOS Code Signature Invalidation
id: b0115e23-4ad1-4f98-82b3-9815cb826906
status: experimental
description: 'Detects code signature invalidation events which may indicate tampering
  with

  signed binaries or attempts to bypass code signing requirements. This is a

  critical security event that should be investigated immediately.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1553/002/
- https://attack.mitre.org/techniques/T1222/
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection:
    esf.event_type: 62
    event.action: cs_invalidated
  condition: selection
falsepositives:
- Development and testing with unsigned binaries
- Software updates and installations
- Legitimate modifications to system files (rare)
fields:
- event_type
- event_name
- ProcessId
- Image
- User
tags:
- attack.defense_evasion
- attack.t1553.002
- attack.t1222
level: critical