Code Signing Policy Modification Through Registry

Attackers may attempt to disable the Windows code signing policy through registry modifications, specifically targeting the BehaviorOnFailedVerify value. Code signing is a security mechanism that ensures the authenticity and integrity of software. Disabling this policy allows the execution of unsigned or self-signed code, enabling threat actors to load malicious drivers or execute other unauthorized software. This technique bypasses a key security control designed to prevent the loading of untrusted code into the Windows kernel. This poses a significant threat to system integrity and security. The targeted registry key is HKEY_USERS\\*\\Software\\Policies\\Microsoft\\Windows NT\\Driver Signing\\BehaviorOnFailedVerify.

Attack Chain

1. The attacker gains initial access to the system through an exploit, social engineering, or compromised credentials.
2. The attacker elevates privileges to obtain the necessary permissions to modify the registry, often using tools like PowerShell or psexec.
3. The attacker uses registry modification tools like reg.exe or PowerShell's Set-ItemProperty cmdlet to modify the BehaviorOnFailedVerify registry value.
4. The BehaviorOnFailedVerify registry value is changed to "0" or "1" to disable driver signature enforcement.
5. The attacker loads a malicious, unsigned driver into the system, leveraging the disabled code signing policy.
6. The malicious driver executes with kernel-level privileges, allowing the attacker to perform arbitrary actions on the system.
7. The attacker uses the compromised system as a beachhead for lateral movement within the network, installing backdoors and exfiltrating sensitive data.

Impact

Disabling code signing enforcement allows attackers to load malicious, unsigned drivers, leading to kernel-level compromise. This can result in complete system control, data theft, and the installation of persistent backdoors. Successful attacks can compromise entire networks, enabling widespread data breaches and significant financial losses. The rule has a risk score of 47 and medium severity.

Recommendation

• Deploy the Sigma rule "Code Signing Policy Modification Through Registry" to your SIEM to detect unauthorized changes to the BehaviorOnFailedVerify registry value.
• Enable Sysmon registry event logging to capture registry modifications and provide the data needed to activate the Sigma rule.
• Investigate any alerts generated by the Sigma rule, focusing on the process execution chain and user accounts involved.
• Ensure that Driver Signature Enforcement is enabled on all systems, and implement policies to prevent users from disabling it.