Threadlinqs IntelligenceStart free

ATT&CK techniqueResource Development

T1588.003 Code Signing Certificates

Resource DevelopmentEnterpriseSub-technique

As of 2026-10-05, T1588.003 (Code Signing Certificates) appears in 21 tracked threats, first reported 2026-02-27 and most recently 2026-09-15, with linked actors including MuddyWater, UNC1549, APT43; it most often appears alongside T1553.002 (Code Signing).

Tracked threats
213 critical, 18 high
First seen
2026-02-27
Last seen
2026-09-15
Threat actors
9In the threats using it
Detection rules
10Blue tier and above

Data as of:

Activity timeline

T1588.003 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 8 reports, and 21 of the 21 threats were reported in the twelve months to 2026-09.

How adversaries use it

T1588.003 Code Signing Certificates is catalogued by MITRE ATT&CK under the Resource Development tactic in the Enterprise matrix, as a sub-technique of T1588 Obtain Capabilities. Threadlinqs maps 21 of 2623 tracked threats (0.8%) to it; by severity that is 3 critical, 18 high.

Threats that use T1588.003 most often also use T1553.002 Code Signing (20 threats), T1036.005 Match Legitimate Resource Name or Location (19 threats), T1071.001 Web Protocols (19 threats), T1204.002 Malicious File (18 threats), T1082 System Information Discovery (16 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

9 tracked threat actors appear in the threats that use T1588.003; the most frequent are MuddyWater (2), UNC1549 (2), APT43 (1), Earth Lusca (1), Kimsuky (1).

Mitigations

MITRE ATT&CK lists 1 mitigation for T1588.003.

Data sources

Telemetry that can reveal T1588.003, per MITRE ATT&CK.

  • Malware Repository — Malware Metadata

Threat actors using it

Tracked threats

21 tracked threats use T1588.003.

Detection coverage

Threadlinqs maintains 10 detection rules mapped to T1588.003 (SPL 3, KQL 3, Sigma 4). Rule content is available to Blue tier accounts and above; this page shows counts only.

10 detection rules (SPL/KQL/Sigma) · Blue and above. Compare plans

Parent technique

T1588 Obtain Capabilities — 363 tracked threats at the technique level.