Techniques › T1553
T1553 Subvert Trust Controls
defense impairment — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
4
Sigma rules tagged attack.t1553
0
KEV CVEs mapped here
<p>Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site.</p><p>Adversaries may attempt to subvert these trust mechanisms. The method adversaries use will depend on the specific mechanism they seek to subvert. Adversaries may conduct File and Directory Permissions Modification or Modify Registry in support of subverting these controls. Adversaries may also create or steal code signing certificates to acquire trust on target systems.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0452 Detect Subversion of Trust Controls via Certificate, Registry, and Attribute Manipulation v1.0
AN1246 WindowsDetection correlates abnormal installation or modification of root or code-signing certificates, creation/modification of suspicious registry keys for trust providers, and unusual module loads from non-standard locations. Identifies unsigned or improperly signed executables bypassing trust prompts, combined with persistence artifacts.Tunable:
TrustedPublisherListFilePathAllowListTimeWindowAN1247 LinuxDetection monitors extended attribute manipulation (xattr) to strip quarantine or trust metadata, anomalous installation of root certificates in /etc/ssl or /usr/local/share/ca-certificates, and unauthorized modification of system trust stores. Correlates with unexpected process execution involving package managers or custom certificate utilities.auditd:SYSCALLchmod, chown, setxattr, or file writes to /etc/ssl/* or /usr/local/share/ca-certificates/*→ DC0059 File Metadataauditd:EXECVEProcess execution of update-ca-certificates or openssl with suspicious arguments→ DC0064 Command ExecutionTunable:CertificatePathListRegexPatternsAN1248 macOSDetection monitors modification of code signing attributes, Gatekeeper/quarantine flags, and insertion of new trust certificates via security add-trusted-cert. Identifies adversary use of xattr to strip quarantine flags from downloaded binaries. Correlates with abnormal module loads bypassing SIP protections.macos:unifiedlogxattr -d com.apple.quarantine or similar removal commands→ DC0064 Command Executionmacos:osqueryUnsigned or ad-hoc signed process executions in user contexts→ DC0032 Process CreationTunable:QuarantineBypassAllowListCertificateAuthorityList
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1553
Author: Matt Anderson (Huntress)
· 2024-07-23 · logsource: product=windows category=process_creation · 0090b851-3543-42db-828c-02fee986ff0b
Detects the use of software that is related to the University of California, Berkeley via metadata information.
This indicates it may be related to BOINC software and can be used maliciously if unauthorized.
Author: Matt Anderson (Huntress)
· 2024-07-23 · logsource: product=windows category=process_creation · 30d07da2-83ab-45d8-ae75-ec7c0edcaffc
Detects the execution of a renamed BOINC binary.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4
Detects when the macOS Script Editor utility spawns an unusual child process.
Author: Florian Roth (Nextron Systems), Maxime Thiebaut
· 2021-08-23 (modified 2024-12-01) · logsource: product=windows category=process_creation · a4eaf250-7dc1-4842-862a-5e71cd59a167
Detects a explorer.exe sub process of the RazerInstaller software which can be invoked from the installer to select a different installation folder but can also be exploited to escalate privileges to LOCAL SYSTEM