Code Signing Policy Modification

Subtechnique · ATTACK:enterprise:T1553.006

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1553.006",
  "title": "Code Signing Policy Modification",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1553/006",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--565275d5-fcc3-4b66-b4e7-928e4cac6b8c",
  "external_id": "T1553.006",
  "domain": "enterprise",
  "created": "2021-04-23T01:04:57.161Z",
  "modified": "2026-05-12T15:12:00.634Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "defense-impairment"
  ],
  "source_references": [
    {
      "source_name": "Apple Disable SIP",
      "url": "https://developer.apple.com/documentation/security/disabling_and_enabling_system_integrity_protection"
    },
    {
      "source_name": "F-Secure BlackEnergy 2014",
      "url": "https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf"
    },
    {
      "source_name": "FireEye HIKIT Rootkit Part 2",
      "url": "https://web.archive.org/web/20210920172620/https://www.fireeye.com/blog/threat-research/2012/08/hikit-rootkit-advanced-persistent-attack-techniques-part-2.html"
    },
    {
      "source_name": "Microsoft Unsigned Driver Apr 2017",
      "url": "https://docs.microsoft.com/en-us/windows-hardware/drivers/install/installing-an-unsigned-driver-during-development-and-test"
    },
    {
      "source_name": "Microsoft DSE June 2017",
      "url": "https://docs.microsoft.com/en-us/previous-versions/windows/hardware/design/dn653559(v=vs.85)?redirectedfrom=MSDN"
    },
    {
      "source_name": "Microsoft TESTSIGNING Feb 2021",
      "url": "https://docs.microsoft.com/en-us/windows-hardware/drivers/install/the-testsigning-boot-configuration-option"
    },
    {
      "source_name": "Unit42 AcidBox June 2020",
      "url": "https://unit42.paloaltonetworks.com/acidbox-rare-malware/"
    },
    {
      "source_name": "GitHub Turla Driver Loader",
      "url": "https://github.com/hfiref0x/TDL"
    }
  ]
}

Explicit source assertions (9)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.