Cross-source coverage

T1553 / ATT&CK

Subvert Trust Controls

74 rules · 72 families across 7 sources.

From MITRE ATT&CK 19.2

Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site.

Adversaries may attempt to subvert these trust mechanisms. The method adversaries use will depend on the specific mechanism they seek to subvert. Adversaries may conduct File and Directory Permissions Modification or Modify Registry in support of subverting these controls. Adversaries may also create or steal code signing certificates to acquire trust on target systems.

Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLauditd:EXECVEmacos:unifiedlogmacos:osquery

How MITRE says to detect it DET0452

Detect Subversion of Trust Controls via Certificate, Registry, and Attribute Manipulation

Windows Analytic 1246

Detection correlates abnormal installation or modification of root or code-signing certificates, creation/modification of suspicious registry keys for trust providers, and unusual module loads from non-standard locations. Identifies unsigned or improperly signed executables bypassing trust prompts, combined with persistence artifacts.

  • WinEventLog:Security EventCode=4657
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Sysmon EventCode=1

Linux Analytic 1247

Detection monitors extended attribute manipulation (xattr) to strip quarantine or trust metadata, anomalous installation of root certificates in /etc/ssl or /usr/local/share/ca-certificates, and unauthorized modification of system trust stores. Correlates with unexpected process execution involving package managers or custom certificate utilities.

  • auditd:SYSCALL chmod, chown, setxattr, or file writes to /etc/ssl/* or /usr/local/share/ca-certificates/*
  • auditd:EXECVE Process execution of update-ca-certificates or openssl with suspicious arguments

macOS Analytic 1248

Detection monitors modification of code signing attributes, Gatekeeper/quarantine flags, and insertion of new trust certificates via security add-trusted-cert. Identifies adversary use of xattr to strip quarantine flags from downloaded binaries. Correlates with abnormal module loads bypassing SIP protections.

  • macos:unifiedlog New certificate trust settings added by unexpected process
  • macos:unifiedlog xattr -d com.apple.quarantine or similar removal commands
  • macos:osquery Unsigned or ad-hoc signed process executions in user contexts

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 74 above — a rule tagged a sub-technique covers this technique too.

SigmaHQ/sigma

24 rules
Detection Severity Format
Cisco Crypto Commands High Sigma
Root Certificate Installed From Susp Locations High Sigma
Suspicious RazerInstaller Explorer Subprocess High Sigma
Kapeka Backdoor Configuration Persistence Medium Sigma
New Root Certificate Installed Via CertMgr.EXE Medium Sigma
New Root Certificate Installed Via Certutil.EXE Medium Sigma
Persistence Via New SIP Provider Medium Sigma
Potential Secure Deletion with SDelete Medium Sigma
Renamed BOINC Client Execution Medium Sigma
Root Certificate Installed - PowerShell Medium Sigma

+ 14 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/detection-rules

17 rules
Detection Severity Format
Gatekeeper Override and Execution High Elastic TOML
Potential Masquerading as System32 DLL High Elastic TOML
Suspicious Curl from macOS Application High Elastic TOML
Suspicious Outbound Network Connection via Unsigned Binary High Elastic TOML
Attempt to Disable Gatekeeper Medium Elastic TOML
Attempt to Install Root Certificate Medium Elastic TOML
Code Signing Policy Modification Through Built-in tools Medium Elastic TOML
Code Signing Policy Modification Through Registry Medium Elastic TOML
Expired or Revoked Driver Loaded Medium Elastic TOML
Quarantine Attrib Removed by Unsigned or Untrusted Process Medium Elastic TOML

+ 7 more from elastic/detection-rules → showing the 10 highest-severity

socfortress/Wazuh-Rules

13 rules
Detection Severity Format
CA trust database updated (T1553.004) High Wazuh XML
Certificate copied to /etc/pki/ca-trust/source/anchors/ (T1553.004) High Wazuh XML
Certificate copied to /usr/local/share/certs (T1553.004) High Wazuh XML
Certificate moved to /usr/local/share/ca-certificates/ (T1553.004) High Wazuh XML
Sysmon - Event 1: Process creation · BCDedit TestSigning Enable (T1553.006) High Wazuh XML
Sysmon - Event 1: Process creation · Execute from ISO (T1553.005) High Wazuh XML
Sysmon - Event 1: Process creation · Mount ISO via PowerShell (T1553.005) High Wazuh XML
Sysmon - Event 1: Process creation · PowerShell MOTW Bypass Unblock-File (T1553.005) High Wazuh XML
Sysmon - Event 1: Process creation · Subvert Trust Controls: Install Root Certificate (T1553.004) High Wazuh XML
OpenSSL used to generate root certificate and key (T1553.004) Medium Wazuh XML

+ 3 more from socfortress/Wazuh-Rules → showing the 10 highest-severity

splunk/security_content

10 rules
Detection Severity Format
MacOS Gatekeeper Bypass Undefined SPL
Windows Advanced Installer MSIX with AI_STUBS Execution Undefined SPL
Windows AppX Deployment Full Trust Package Installation Undefined SPL
Windows AppX Deployment Unsigned Package Installation Undefined SPL
Windows Developer-Signed MSIX Package Installation Undefined SPL
Windows Mark Of The Web Bypass Undefined SPL
Windows Registry Certificate Added Undefined SPL
Windows Registry SIP Provider Modification Undefined SPL
Windows SIP Provider Inventory Undefined SPL
Windows SIP WinVerifyTrust Failed Trust Validation Undefined SPL

elastic/protections-artifacts

7 rules
Detection Severity Format
Potential Payload Download via AppleScript Applet Undefined Elastic TOML
Quarantine Attribute Deleted via Untrusted Binary Undefined Elastic TOML
Quarantine Attribute Removal via TextEdit Undefined Elastic TOML
Quarantine Cleared via Xattr Followed by Ad-hoc Codesign Undefined Elastic TOML
Suspicious Execution via Script Editor Undefined Elastic TOML
Suspicious File Quarantine Removal via Find Undefined Elastic TOML
Suspicious Stop of TCCD via Launchctl Undefined Elastic TOML

Bert-JanP/Hunting-Queries-Detection-Rules

2 rules
Detection Severity Format
Hunt for rare ISO files on devices Undefined KQL
MITRE ATT&CK Mapping Undefined KQL

Azure/Azure-Sentinel

1 rule
Detection Severity Format
Short-lived ephemeral code signing certificates Undefined KQL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.