References and further reading about code signing:



Code Signing Summaries



https://www.computer.org/publications/tech-news/trends/what-is-a-code-signing-certificate
https://www.websecurity.digicert.com/security-topics/how-code-signing-works 
https://www.venafi.com/education-center/code-signing/what-is-code-signing


Authenticode (Windows Code Signing)



https://learn.microsoft.com/en-us/windows-hardware/drivers/install/digital-signatures
https://learn.microsoft.com/en-us/windows-hardware/drivers/install/authenticode
https://reversea.me/index.php/authenticode-i-understanding-windows-authenticode/


Code Signing Formats



https://en.wikipedia.org/wiki/X.509 (Certificate format)
https://en.wikipedia.org/wiki/PKCS_7 (Container for certificate in executables)
https://datatracker.ietf.org/doc/html/rfc5280#section-4.1 (X.509 certificate structure)




Malware and Code Signing Techniques



Study of code signing and malware
http://users.umiacs.umd.edu/~tdumitra/papers/CCS-2017.pdf
Certificate "glomming" (invalid certificate)
https://attack.mitre.org/techniques/T1036/001/
Using bought or stolen certificates
https://attack.mitre.org/techniques/T1553/002/
https://attack.mitre.org/techniques/T1588/003/
Signed drivers
https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware
