# codesign

> Create, manipulate and verify code signatures.

The codesign command is used to create, check, and display code signatures, as well as inquire into the dynamic status of signed code in the system.

- Page: https://loobins.io/binaries/codesign/
- Author: Thijs Xhaflaire
- Created: 2024-07-29
- Tactics: Defense Evasion

## Paths

- `/usr/bin/codesign`

## Example Use Cases

### Ad-hoc codesigning an app bundle

This command forcefully re-signs the MyApp.app application with an ad-hoc signature, applying the signature deeply to all nested code within the app

```bash
codesign --force --deep -s - MyApp.app
```

- Tactics: Defense Evasion
- Tags: codesign

## Detections

- [Jamf Protect: Detect ad-hoc codesigning activity](https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/adhoc_codesigning.yaml)

## Resources

- [When Apple Admits macOS Malware Is A Problem – It’s Time To Take Notice](https://www.sentinelone.com/blog/when-apple-admits-macos-malware-is-a-problem-its-time-to-take-notice/)
- [codesign man page](https://ss64.com/mac/codesign.html)