Ad-hoc re-signing of application bundle via codesign -s -

Duo Tech@duotech

•updated Jul 14, 2026•0•0•1

Detects the use of the macOS 'codesign' utility with command-line flags that suggest an attempt to sign a binary with an empty or improperly formatted identity string. This pattern is often used to quickly sign binaries with an ad-hoc signature to bypass security restrictions or for malicious purposes.