Applied Cybernetics Group
T1553 Subvert Trust Controls
- Technique
T1553- Tactics
- Defense Evasion
- Research, 90 days
- 2
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 4
- Elastic, Splunk
- 20
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1553
MITRE description
Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site. Adversaries may attempt to subvert these trust mechanisms. The method adversaries use will depend on the specific mechanism they seek to subvert. Adversaries may conduct [File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222) or [Modify Registry](https://attack.mitre.org/techniques/T1112) in support of subverting these controls.(Citation: SpectorOps Subverting Trust Sept 2017) Adversaries may also create or steal code signing certificates to acquire trust on target systems.(Citation: Securelist Digital Certificates)(Citation: Symantec Digital Certificates)
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-11-05Kaspersky Securelist: The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603 -
2026-08-13Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them
Detection coverage
SigmaHQ community rules
- Suspicious RazerInstaller Explorer Subprocess (emerging-threats)
- Potential BOINC Software Execution (UC-Berkeley Signature) (threat-hunting)
- Suspicious Execution via macOS Script Editor (core)
- Renamed BOINC Client Execution (core)
Elastic and Splunk rules
- ESXi Attempt to Force Install a VMware VIB Package (elastic)
- ESXi Host Prepared for an Unsigned Install (elastic)
- Root Certificate Installation (elastic)
- SSL Certificate Deletion (elastic)
- Suspicious Kernel Feature Activity (elastic)
- Suspicious Curl from macOS Application (elastic)
- Suspicious Outbound Network Connection via Unsigned Binary (elastic)
- Quarantine Attrib Removed by Unsigned or Untrusted Process (elastic)
- Attempt to Disable Gatekeeper (elastic)
- Gatekeeper Override and Execution (elastic)
- Attempt to Install Root Certificate (elastic)
- Code Signing Policy Modification Through Built-in tools (elastic)
- Code Signing Policy Modification Through Registry (elastic)
- Creation or Modification of Root Certificate (elastic)
- Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601 - CurveBall) (elastic)
- Mark-of-the-Web Removal by an Unusual Process (elastic)
- Potential Masquerading as System32 DLL (elastic)
- SIP Provider Modification (elastic)
- Expired or Revoked Driver Loaded (elastic)
- Potential Masquerading as System32 Executable (elastic)