T1553.006 — Code Signing Policy Modification

Tactic: Defense Impairment · Platforms: macOS, Windows

Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. Code signing provides a level of authenticity on a program from a developer and a guarantee that the program has not been tampered with. Security controls can include enforcement mechanisms to ensure…

Sub-technique of Subvert Trust Controls (T1553).

Sigma detection rules (2)

T1553.006 Subvert Trust Controls: Code Signing Policy Modification

title: "T1553.006 Subvert Trust Controls: Code Signing Policy Modification"
id: 853ca3f8-f311-4d44-a5a5-0a9b0055aced
description: 'Detect Code Signing Policy Modification (Windows & macOS). (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: MonitoredExecutables, RegistryPaths, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1553/006
author: Shahrukh Khan
date: 2026-03-19
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1553.006

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains|all:
      - 'set'
      - 'testsigning'
      - 'on'

  condition: selection

falsepositives:
  - Legitimate driver-development/testing on developer workstations; essentially never legitimate on standard production endpoints.

level: critical

T1553.006 Subvert Trust Controls: Code Signing Policy Modification

title: "T1553.006 Subvert Trust Controls: Code Signing Policy Modification"
id: eaecba54-8a80-4f61-a78a-a96f0c6f8699
description: 'Detect Code Signing Policy Modification (Windows & macOS). (Retargeted to the file_change macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: PolicyPaths, AllowedUsers, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1553/006
author: Shahrukh Khan
date: 2026-02-25
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1553.006

logsource:
  category: file_change
  product: macos

detection:
  selection:
    TargetFilename|contains:
      - '/var/db/SystemPolicyConfiguration/'
      - '/Library/Preferences/com.apple.security'
  condition: selection

falsepositives:
  - Legitimate MDM security policy pushes and Apple system updates modify the same SystemPolicyConfiguration database, so a file_change event alone cannot confirm an unauthorized code signing policy change without knowing the modifying process was not syspolicyd or a management agent, and there is no true registry_set equivalent on macOS so this indicator is only an approximation.

level: high

Related sub-techniques

Explore