Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Create T1553.006.md * Create T1553.006.yaml * Update T1553.006.yaml * Update T1553.006.md * Update T1553.006.md * Update T1553.006.md --------- Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
- Loading branch information
Showing
2 changed files
with
22 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,10 @@ | ||
# T1553.006 - Subvert Trust Controls: Code Signing Policy Modification | ||
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1553/006) | ||
<blockquote>Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. Code signing provides a level of authenticity on a program from a developer and a guarantee that the program has not been tampered with. Security controls can include enforcement mechanisms to ensure that only valid, signed code can be run on an operating system. | ||
|
||
Some of these security controls may be enabled by default, such as Driver Signature Enforcement (DSE) on Windows or System Integrity Protection (SIP) on macOS. Other such controls may be disabled by default but are configurable through application controls, such as only allowing signed Dynamic-Link Libraries (DLLs) to execute on a system. Since it can be useful for developers to modify default signature enforcement policies during the development and testing of applications, disabling of these features may be possible with elevated permissions. | ||
|
||
Adversaries may modify code signing policies in a number of ways, including through use of command-line or GUI utilities, Modify Registry, rebooting the computer in a debug/recovery mode, or by altering the value of variables in kernel memory. Examples of commands that can modify the code signing policy of a system include bcdedit.exe -set TESTSIGNING ON on Windows and csrutil disable on macOS. Depending on the implementation, successful modification of a signing policy may require reboot of the compromised system. Additionally, some implementations can introduce visible artifacts for the user (ex: a watermark in the corner of the screen stating the system is in Test Mode). Adversaries may attempt to remove such artifacts. | ||
|
||
To gain access to kernel memory to modify variables related to signature checks, such as modifying g_CiOptions to disable Driver Signature Enforcement, adversaries may conduct Exploitation for Privilege Escalation using a signed, but vulnerable driver. | ||
</blockquote> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,12 @@ | ||
attack_technique: T1553.006 | ||
display_name: 'Subvert Trust Controls: Code Signing Policy Modification' | ||
atomic_tests: | ||
- name: Code Signing Policy Modification | ||
description: Allows adversaries to subvert trust controls by modifying the code signing policy, enabling the execution of unsigned drivers. | ||
supported_platforms: | ||
- windows | ||
executor: | ||
command: bcdedit /set testsigning on | ||
cleanup_command: bcdedit /set testsigning off | ||
name: command_prompt | ||
elevation_required: true |
56b0e29
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@johnk3r @clr2of8 This test is missing a guid