Skip to content

T1553.006 Code Signing Policy Modification

Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. Code signing provides a level of authenticity on a program from a developer and a guarantee that the program has not been tampered with. Security controls can include enforcement mechanisms to ensure that only valid, signed code can be run on an operating system.

Some of these security controls may be enabled by default, such as Driver Signature Enforcement (DSE) on Windows or System Integrity Protection (SIP) on macOS.51 Other such controls may be disabled by default but are configurable through application controls, such as only allowing signed Dynamic-Link Libraries (DLLs) to execute on a system. Since it can be useful for developers to modify default signature enforcement policies during the development and testing of applications, disabling of these features may be possible with elevated permissions.41

Adversaries may modify code signing policies in a number of ways, including through use of command-line or GUI utilities, Modify Registry, rebooting the computer in a debug/recovery mode, or by altering the value of variables in kernel memory.6138 Examples of commands that can modify the code signing policy of a system include bcdedit.exe -set TESTSIGNING ON on Windows and csrutil disable on macOS.61 Depending on the implementation, successful modification of a signing policy may require reboot of the compromised system. Additionally, some implementations can introduce visible artifacts for the user (ex: a watermark in the corner of the screen stating the system is in Test Mode). Adversaries may attempt to remove such artifacts.2

To gain access to kernel memory to modify variables related to signature checks, such as modifying g_CiOptions to disable Driver Signature Enforcement, adversaries may conduct Exploitation for Privilege Escalation using a signed, but vulnerable driver.78

Item Value
ID T1553.006
Sub-techniques T1553.001, T1553.002, T1553.003, T1553.004, T1553.005, T1553.006
Tactics TA0005
Platforms Windows, macOS
Version 1.0
Created 23 April 2021
Last Modified 05 May 2022

Procedure Examples

ID Name Description
G0087 APT39 APT39 has used malware to turn off the RequireSigned feature which ensures only signed DLLs can be run on Windows.10
S0089 BlackEnergy BlackEnergy has enabled the TESTSIGNING boot configuration option to facilitate loading of a driver component.2
S0009 Hikit Hikit has attempted to disable driver signing verification by tampering with several Registry keys prior to the loading of a rootkit driver component.3
S0664 Pandora Pandora can use CVE-2017-15303 to disable Windows Driver Signature Enforcement (DSE) protection and load its driver.9
G0010 Turla Turla has modified variables in kernel memory to turn off Driver Signature Enforcement after exploiting vulnerabilities that obtained kernel mode privileges.78

Mitigations

ID Mitigation Description
M1046 Boot Integrity Use of Secure Boot may prevent some implementations of modification to code signing policies.6
M1026 Privileged Account Management Limit the usage of local administrator and domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries.
M1024 Restrict Registry Permissions Ensure proper permissions are set for the Registry to prevent users from modifying keys related to code signing policies.

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0009 Process Process Creation
DS0024 Windows Registry Windows Registry Key Modification

References

  1. Apple. (n.d.). Disabling and Enabling System Integrity Protection. Retrieved April 22, 2021. ↩↩↩↩

  2. F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016. ↩↩

  3. Glyer, C., Kazanciyan, R. (2012, August 22). The “Hikit” Rootkit: Advanced and Persistent Attack Techniques (Part 2). Retrieved May 4, 2020. ↩↩

  4. Microsoft. (2017, April 20). Installing an Unsigned Driver during Development and Test. Retrieved April 22, 2021. ↩

  5. Microsoft. (2017, June 1). Digital Signatures for Kernel Modules on Windows. Retrieved April 22, 2021. ↩

  6. Microsoft. (2021, February 15). Enable Loading of Test Signed Drivers. Retrieved April 22, 2021. ↩↩↩

  7. Reichel, D. and Idrizovic, E. (2020, June 17). AcidBox: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations. Retrieved March 16, 2021. ↩↩

  8. TDL Project. (2016, February 4). TDL (Turla Driver Loader). Retrieved April 22, 2021. ↩↩↩

  9. Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021. ↩

  10. FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020. ↩