tfMITRE ATT&CK sub-technique

Code Signing Policy Modification T1553.006

sub-technique of T1553 Subvert Trust Controls

Tactic: Defense Impairment
Platforms: macOS, Windows
Version: 2.0
Created: 23 April 2021
Last modified: 12 May 2026
Contributor: Abel Morales, Exabeam

Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. Code signing provides a level of authenticity on a program from a developer and a guarantee that the program has not been tampered with. Security controls can include enforcement mechanisms to ensure that only valid, signed code can be run on an operating system.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware57th pct

Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Code Signing Policy Modification MITRE reference T1553.006

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

APT39G0087 ↗

Has used malware to turn off the RequireSigned feature which ensures only signed DLLs can be run on Windows.1

created 2019-02-191 referenceaka ITG07

TurlaG0010 ↗

Has modified variables in kernel memory to turn off Driver Signature Enforcement after exploiting vulnerabilities that obtained kernel mode privileges.1 2

created 2017-05-312 referencesaka IRON HUNTER

All 2 groups for this technique

3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

PandoraS0664 ↗

Can use CVE-2017-15303 to disable Windows Driver Signature Enforcement (DSE) protection and load its driver.1

created 2021-11-29MALWAREcarried by 2 groups

BlackEnergyS0089 ↗

Has enabled the TESTSIGNING boot configuration option to facilitate loading of a driver component.1

created 2017-05-31MALWAREcarried by 1 group

HikitS0009 ↗

Has attempted to disable driver signing verification by tampering with several Registry keys prior to the loading of a rootkit driver component.1

created 2017-05-31MALWAREcarried by 1 group

All 3 software entries for this technique

Offense vs defense T1553.006

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Code Signing Policy Modification detection strategy DET0523

MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Code Signing Policy Modification (Windows & macOS)

Enterprise

2 platforms

AN1446 · Windows

Monitors execution of administrative utilities (e.g., bcdedit.exe) or registry modifications that disable Driver Signature Enforcement (DSE) or enable Test Signing. Correlates command-line activity, registry changes, and subsequent process executions that bypass signing enforcement.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Windows Registry Key ModificationDC0063	WinEventLog:Security	EventCode=4657

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredExecutables	Expand or restrict monitored utilities (e.g., bcdedit.exe, reg.exe) based on enterprise usage
RegistryPaths	Customize registry paths tied to Driver Signing enforcement depending on OS version
TimeWindow	Correlation window between registry modification and subsequent unsigned binary execution

AN1447 · macOS

Detects modification of System Integrity Protection (SIP) or code signing enforcement policies through csrutil or kernel variable tampering. Correlates execution of csrutil disable commands with subsequent policy state changes and anomalous unsigned process executions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Unsigned binary execution following SIP change
Windows Registry Key ModificationDC0063	macos:unifiedlog	g_CiOptions modification or SIP state change
Command ExecutionDC0064	macos:unifiedlog	csrutil disable

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PolicyPaths	Track configuration files and kernel extensions tied to SIP enforcement
AllowedUsers	Restrict or expand which privileged accounts are monitored for SIP/CSRUTIL changes
TimeWindow	Define correlation between csrutil execution and unsigned process activity

Tests1Executorscmd 1Need elevation1 of 1Have prerequisites0Have cleanup1Platformswindows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup	Ref
01	Code Signing Policy Modification	windows	cmd	Required	—	Yes
Allows adversaries to subvert trust controls by modifying the code signing policy, enabling the execution of unsigned drivers. Attack command bcdedit /set testsigning on Cleanup command bcdedit /set testsigning off GUID418cdbe3-0cd4-47b3-b6b9-9e5fb5ef9ef4

Tests from Atomic Red Team (MIT licence) · technique definition

Code Signing Policy Modification detections T1553.006

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs