T1553.006sub-technique of T1553 Subvert Trust Controls
Code Signing Policy Modification
macOS · Windowsnothing on this site yetT1553.006 on attack.mitre.org
Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. Code signing provides a level of authenticity on a program from a developer and a guarantee that the program has not been tampered with. Security controls can include enforcement mechanisms to ensure that only valid, signed code can be run on an operating system.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Ransomware, suspected or confirmed
Files renamed or unreadable, a ransom note, or backup deletion commands seen.
how MITRE says to see it
Detect Code Signing Policy Modification (Windows & macOS)
- Monitors execution of administrative utilities (e.g., bcdedit.exe) or registry modifications that disable Driver Signature Enforcement (DSE) or enable Test Signing. Correlates command-line activity, registry changes, and subsequent process executions that bypass signing enforcement.
- Detects modification of System Integrity Protection (SIP) or code signing enforcement policies through csrutil or kernel variable tampering. Correlates execution of csrutil disable commands with subsequent policy state changes and anomalous unsigned process executions.
what reduces it
- M1046 Boot Integrity. Use of Secure Boot may prevent some implementations of modification to code signing policies.
- M1026 Privileged Account Management. Limit the usage of local administrator and domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries.
- M1024 Restrict Registry Permissions. Ensure proper permissions are set for the Registry to prevent users from modifying keys related to code signing policies.