Detection rules › Sigma
macOS Code Signature Invalidation
Detects code signature invalidation events which may indicate tampering with signed binaries or attempts to bypass code signing requirements. This is a critical security event that should be investigated immediately.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment | T1222 File and Directory Permissions Modification, T1553.002 Subvert Trust Controls: Code Signing |
Rule body yaml
title: macOS Code Signature Invalidation
id: b0115e23-4ad1-4f98-82b3-9815cb826906
status: experimental
description: 'Detects code signature invalidation events which may indicate tampering
with
signed binaries or attempts to bypass code signing requirements. This is a
critical security event that should be investigated immediately.
'
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1553/002/
- https://attack.mitre.org/techniques/T1222/
logsource:
product: macos
service: endpointsecurity
detection:
selection:
esf.event_type: 62
event.action: cs_invalidated
condition: selection
falsepositives:
- Development and testing with unsigned binaries
- Software updates and installations
- Legitimate modifications to system files (rare)
fields:
- event_type
- event_name
- ProcessId
- Image
- User
tags:
- attack.defense_evasion
- attack.t1553.002
- attack.t1222
level: critical
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
esf.event_type: 62
event.action: cs_invalidated
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
esf.event_type | eq |
|
event.action | eq |
|