bcdedit invoked to disable driver signature enforcement or test signing

Siemphony@siemphonymediumT1553.006unverified

AN1446 names "administrative utilities (e.g., bcdedit.exe)" that "disable Driver Signature Enforcement (DSE) or enable Test Signing" as its process-creation signal, and this rule matches that directly: `bcdedit.exe` with a command line containing one of the documented boot-configuration edits that weaken code-signing enforcement for drivers — `testsigning` (permits self-signed and test-signed drivers to load) or `nointegritychecks` (disables Driver Signature Enforcement outright on BIOS/legacy boot) set to a true value, or the `loadoptions DISABLE_INTEGRITY_CHECKS` spelling of the same setting. bcdedit's boolean element type takes four interchangeable spellings for "true" — `on`, `yes`, `1` and `true` (and the same four for "false") — so an earlier draft matching only `on`/`yes` left `bcdedit /set testsigning 1` and `bcdedit /set testsigning true` as an unfiltered bypass despite being no less standard a spelling; all four true-spellings are matched here for both directives so the selector cannot be evaded just by choosing a different synonym for the same setting. AN1446's second logsource, Security EventID 4657 mapped onto `registry_set`, is deliberately not used. Unlike the registry-based rules elsewhere in this corpus, the Boot Configuration Data this setting lives in is not a normal HKLM/HKCU key with a SACL an administrator would set — it is a separate BCD hive file (`\Boot\BCD` or its ESP equivalent) that Windows loads and edits through boot-configuration APIs, not through the registry calls 4657 audits in a default or CIS-baseline configuration. Asserting a `registry_set` path here without that hive being explicitly loaded and audited would be the telemetry-off-by-default trap this pipeline exists to avoid, so this rule states the limitation instead of a path that would return nothing. AN1447 (macOS: `csrutil disable`, `g_CiOptions` tampering, unsigned execution following a SIP change) is not attempted. Its only logsource is {product: macos, service: unifiedlog}, which has no field vocabulary anywhere in this pipeline — not in the brief, not in lib/sigma, not in Sigma's own taxonomy — the same conclusion already recorded for T1037.002, T1059.002, T1548.004 and T1678 on this identical source. Prerequisite: this needs Security EventID 4688 with *Audit Process Creation* enabled, and separately *Include command line in process creation events* for `CommandLine` to be populated at all; neither is on by default or in the MS/CIS baselines, so a silent rule may mean the command-line policy is off rather than that nobody ran bcdedit. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0523, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (FolderPath endswith "\\bcdedit.exe" and (ProcessCommandLine contains "testsigning on" or ProcessCommandLine contains "testsigning yes" or ProcessCommandLine contains "testsigning 1" or ProcessCommandLine contains "testsigning true" or ProcessCommandLine contains "nointegritychecks on" or ProcessCommandLine contains "nointegritychecks yes" or ProcessCommandLine contains "nointegritychecks 1" or ProcessCommandLine contains "nointegritychecks true" or ProcessCommandLine contains "DISABLE_INTEGRITY_CHECKS"))

Splunk · SPL

Run this as a search.

index=* (Image="*\\bcdedit.exe" AND (CommandLine="*testsigning on*" OR CommandLine="*testsigning yes*" OR CommandLine="*testsigning 1*" OR CommandLine="*testsigning true*" OR CommandLine="*nointegritychecks on*" OR CommandLine="*nointegritychecks yes*" OR CommandLine="*nointegritychecks 1*" OR CommandLine="*nointegritychecks true*" OR CommandLine="*DISABLE_INTEGRITY_CHECKS*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*\\\\bcdedit.exe" AND (TO_LOWER(process.command_line) LIKE "*testsigning on*" OR TO_LOWER(process.command_line) LIKE "*testsigning yes*" OR TO_LOWER(process.command_line) LIKE "*testsigning 1*" OR TO_LOWER(process.command_line) LIKE "*testsigning true*" OR TO_LOWER(process.command_line) LIKE "*nointegritychecks on*" OR TO_LOWER(process.command_line) LIKE "*nointegritychecks yes*" OR TO_LOWER(process.command_line) LIKE "*nointegritychecks 1*" OR TO_LOWER(process.command_line) LIKE "*nointegritychecks true*" OR TO_LOWER(process.command_line) LIKE "*disable_integrity_checks*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\bcdedit\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(testsigning on|testsigning yes|testsigning 1|testsigning true|nointegritychecks on|nointegritychecks yes|nointegritychecks 1|nointegritychecks true|DISABLE_INTEGRITY_CHECKS)</field>    <description>bcdedit invoked to disable driver signature enforcement or test signing</description>    <mitre>      <id>T1553.006</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: defense_evasion_subvert_trust
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 7f4a7913-d3cb-4e2d-9b71-67a73d510044

ATT&CKT1553.006

T1553.006Code Signing Policy Modification

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondefense evasion subvert trust

defense evasion subvert trustAI draft — unreviewed

01 · What this rule detects

This rule watches for bcdedit.exe being used to weaken Windows' code-signing enforcement for drivers — either disabling Driver Signature Enforcement (DSE) outright or enabling Test Signing, which permits self-signed or test-signed drivers to load. AN1446 names "administrative utilities (e.g., bcdedit.exe)" as the process-creation signal for this, and the rule matches that directly rather than inferring it from a broader command-line pattern.

02 · Telemetry you need

Security EventID 4688 (process_creation) on Windows, with two policies both required and neither on by default or in the MS/CIS baselines: Audit Process Creation to get the event at all, and separately Include command line in process creation events for CommandLine to be populated. Without the second policy the event fires but CommandLine is empty, and this rule's directive selector never matches anything — a silent result that means "policy off," not "nobody ran bcdedit."

03 · How the logic works

Two selections combined with and: - selection_binary: Image ends with \bcdedit.exe. - selection_directive: CommandLine contains one of a list of specific boot-configuration edits — testsigning or nointegritychecks set true, or the equivalent loadoptions DISABLE_INTEGRITY_CHECKS spelling. The directive list is the part worth reading closely. bcdedit's boolean element type accepts four interchangeable spellings for "true": on, yes, 1, true. The rule originally matched only on/yes on the reasoning that those were the standard forms — adversarial review found that reasoning wrong: bcdedit /set testsigning 1 and bcdedit /set testsigning true are equally standard, documented syntax, and the original selector let both through untouched. The fix adds all four true-spellings for both testsigning and nointegritychecks, so an operator can't evade the rule by picking a different synonym for the same setting. AN1446's second logsource — Security EventID 4657 mapped onto registry_set — is deliberately not used. Boot Configuration Data isn't a normal HKLM/HKCU key with a SACL; it lives in a separate BCD hive file that Windows edits through boot-configuration APIs, not the registry calls 4657 audits in a default or CIS-baseline setup. Asserting a registry_set selector here without that hive explicitly loaded and audited would be exactly the telemetry-off-by-default trap this pipeline exists to avoid, so the rule states the limitation instead.

04 · Common false positives

All three documented false positives are legitimate uses of the identical command line. Driver developers and WHQL/EV-certification test workstations run bcdedit /set testsigning on routinely to load unsigned test drivers. Automated imaging and build pipelines (WinPE provisioning, nested-VM or lab-image tooling) toggle these same flags as a scripted build step. Kernel-debugging setups on dedicated crash-dump or triage machines commonly leave testsigning on for the workstation's lifetime alongside bcdedit /debug on. level: medium reflects that these are recurring, expected sources on any fleet that does driver work, not rare edge cases.

05 · Detection maturity

tier_1: Lowest tier. Machine-derived from MITRE's analytic description and never executed against a real EventID 4688 stream — validate against real data, including confirming the command-line audit policy is actually enabled, before trusting a quiet result.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Scope the rule down by host role: exclude known driver-development, build-pipeline and kernel-debug machines by hostname or asset tag, since those three groups account for essentially all the expected noise. On a fleet with no legitimate driver-signing exceptions, this rule can run tighter with little tuning at all — the remaining signal is concentrated.

Declared by the author

Driver developers and WHQL/EV-certification test workstations running bcdedit /set testsigning on to load unsigned or self-signed test drivers during ordinary development, the same command line this rule matches.
Automated imaging and build pipelines (WinPE-based provisioning scripts, nested-VM or lab-image build tooling) that toggle testsigning or nointegritychecks as a scripted step when assembling a custom boot image.
Kernel-debugging setups on dedicated crash-dump or driver-triage machines, where testsigning is commonly left on alongside bcdedit /debug on for the lifetime of the workstation.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1553.006, evaluated against their process_creation events.

Share this rule

/u/siemphony/7f4a7913-d3cb-4e2d-9b71-67a73d510044

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

bcdedit invoked to disable driver signature enforcement or test signing

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it