codesign #

Created by Thijs Xhaflaire

Description ##

The codesign command is used to create, check, and display code signatures, as well as inquire into the dynamic status of signed code in the system.

Paths ##

• /usr/bin/codesign

Use Cases ##

Ad-hod codesigning an app bundle ##

This command forcefully re-signs the MyApp.app application with an ad-hoc signature, applying the signature deeply to all nested code within the app

codesign --force --deep -s - MyApp.app

Detections ##

• Jamf Protect: Detect ad-hod codesigning activity

Resources ##

• When Apple Admits macOS Malware Is A Problem – It’s Time To Take Notice

• codesign man page