A signature in this context nearly always means an IoC: https://en.wikipedia.org/wiki/Indicator_of_compromise

Which in weak cases can be an artifact observed throughout the attacks though not necessary for the behaviour to occur (e.g. compiler timestamp), and in strong cases the artifact is tied directly to the malicious behaviour (e.g. explicit registry key or anti-infection marker)