Windows set to permit unsigned drivers (Test Mode)

BIOC Medium

Windows set to permit unsigned drivers (Test Mode)

This host has been set into 'Test Mode' which allows loading of unsigned drivers. It has legitimate uses, but can be leveraged by malware to load malicious untrusted drivers.

Module:: Platform Analytics
Agent event type:: Process execution
Category:: Tampering
Status:: Enabled

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)

Indicator:

Process action type = execution AND target process cmd = */set*testsigning*on* AND target process name = bcdedit.exe

Preventable: yes