ATT&CK technique
View on MITRE ATT&CK →
T1036.001
Invalid Code Signature
Stealth
11 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Suspicious DLL Loaded for Persistence or Privilege Escalation | production | 2026-09-18 |
| elastic | Suspicious Communication App Child Process | production | 2026-09-18 |
| elastic | Potential Masquerading as Business App Installer | production | 2026-09-18 |
| elastic | Potential Masquerading as Communication Apps | production | 2026-09-18 |
| elastic | Potential Masquerading as System32 DLL | production | 2026-09-18 |
| elastic | Unsigned DLL Side-Loading from a Suspicious Folder | production | 2026-09-18 |
| elastic | Untrusted Driver Loaded | production | 2026-09-18 |
| elastic | Unsigned DLL Loaded by Svchost | production | 2026-09-18 |
| elastic | Startup Folder Persistence via Unsigned Process | production | 2026-09-18 |
| elastic | Expired or Revoked Driver Loaded | production | 2026-09-18 |
| elastic | Deprecated - Process Termination followed by Deletion | deprecated | 2026-02-04 |