AD2052: RequireAuthenticode¶

Summary¶

Description¶

Binaries should have Authenticode signatures to verify publisher identity and protect against tampering.

How It Works¶

The rule checks if the PE binary has a certificate table in its data directories. The certificate table contains Authenticode signatures that cryptographically verify:

1. Publisher identity: Who signed the binary
2. Integrity: The binary hasn't been modified since signing
3. Timestamp: When the signature was created

Why This Matters¶

Code Signing Benefits¶

1. Trust establishment: Users and systems can verify the publisher
2. Tamper detection: Any modification invalidates the signature
3. Malware protection: Unsigned binaries are flagged by security software
4. Enterprise deployment: Many organizations require signed software
5. SmartScreen reputation: Windows builds reputation for signed publishers

Windows Security Features¶

Unsigned binaries may be: - Blocked or flagged by SmartScreen - Rejected by enterprise security policies - Unable to use certain Windows features - Flagged by antivirus software

Attack Prevention¶

Code signing prevents: - Supply chain attacks: Modified binaries are detected - Man-in-the-middle attacks: Downloaded software integrity is verified - Trojan distribution: Attackers can't forge legitimate publisher identity

Performance Considerations¶

Authenticode signature verification has minimal runtime impact:

Runtime behavior: - Windows caches signature verification results - Subsequent executions are faster - Network-based timestamp verification is optional after first check

Comparison:

The security benefits far outweigh the minimal performance cost.

Resolution¶

Sign Your Binaries¶

1. Obtain a code signing certificate from a trusted Certificate Authority (CA)
2. Sign the binary using signtool:

signtool sign /fd SHA256 /f certificate.pfx /p password /tr http://timestamp.digicert.com /td SHA256 myapp.exe

Using Visual Studio¶

1. Project Properties → Signing
2. Check Sign the assembly
3. Select your code signing certificate

Verify Signature¶

signtool verify /pa /v myapp.exe

Certificate Options¶

For Open Source Projects¶

Free code signing options: - SignPath Foundation: Free for open source projects - Azure Trusted Signing: Available through Azure - Self-signed for CI/testing: Not for distribution

Related Rules¶

• AD2029: Enable Integrity Check
• AD2022: Sign Securely

References¶

• Authenticode Digital Signatures
• SignTool
• Code Signing Best Practices
• Extended Validation Code Signing