Attack path: Invalid Code Signature
Kill-chain expansion via actor co-occurrence analysis ·
16 techniques ·
11 detectable
·
5 detection gaps
Entry point: CVE-2019-3736
T1036.001
Execution
Persistence
Lateral Movement
Impact
T1488
Disk Content Wipe
× no rule
9.7x lift
T1496
Resource Hijacking
✓ sigma
6.6x lift
T1495
Firmware Corruption
✓ sigma
6.1x lift
T1499.004
Application or System Exploita…
✓ sigma
5.7x lift
T1529
System Shutdown/Reboot
✓ sigma
5.0x lift
T1499
Endpoint Denial of Service
✓ sigma
4.6x lift
T1565.001
Stored Data Manipulation
✓ sigma
3.8x lift
T1565.002
Transmitted Data Manipulation
✓ sigma
3.8x lift
Entry point (from CVE)
Detection rule available
Detection gap - potential blind spot
Lift = how strongly this technique co-occurs with the entry point across shared threat actors (1x = expected, 5x = highly distinctive)
Hunt package
All 16 techniques in this chain - Sigma rules, Atomic tests, and detection gaps in one view.