detection.wiki

Subvert Trust Controls T1553

Tactic: Defense Impairment

Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site.

Events covered

21 catalog events are tagged with this technique by at least one rule.

ProviderEventTitle
SysmonEvent ID 1Process creation
SysmonEvent ID 6Driver loaded
SysmonEvent ID 7Image loaded
SysmonEvent ID 12RegistryEvent (Object create and delete)
SysmonEvent ID 13RegistryEvent (Value Set)
SysmonEvent ID 14RegistryEvent (Key and Value Rename)
SysmonEvent ID 23FileDelete (File Delete archived)
SysmonEvent ID 26FileDeleteDetected (File Delete logged)
Security-AuditingEvent ID 4656A handle to an object was requested.
Security-AuditingEvent ID 4658The handle to an object was closed.
Security-AuditingEvent ID 4663An attempt was made to access an object.
Security-AuditingEvent ID 4688A new process has been created.
ESFexecProcess Execution
AppXDeployment-ServerEvent ID 400Deployment DeploymentOperation operation with target volume MountPoint on Package PackageFullName from: Path finished successfully.
AppXDeployment-ServerEvent ID 603Started deployment DeploymentOperation operation on a package with main parameter Path and Options Flags and FlagsHigh.
AppXDeployment-ServerEvent ID 855Finished resolving action lists.
CAPI2Event ID 81For more details for this event, please refer to the "Details" section
CertificationAuthorityEvent ID 53Active Directory Certificate Services denied request Name because RequestId.
PowerShellEvent ID 4103Payload Context: ContextInfo User Data: UserData.
PowerShellEvent ID 4104Creating Scriptblock text (MessageNumber of MessageTotal).
Sysmon-for-LinuxEvent ID 1Process Create

Authoring guide

These 68 rules share fields, values, and exclusions.

Fields filtered most (50 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
event.type17eq 15, in 2start, change, deletion, process_started
Image15ends_with 9, eq 2, is_not_null 2, contains 1, in 1, starts_with 1, \certutil.exe, *\AI_STUBS\AiStubX64.exe, *\AI_STUBS\AiStubX64Elevated.exe, *\AI_STUBS\AiStubX86.exe
process_basename15eq 10, in 5, starts_with 2, wildcard 2bash, csh, curl, nscurl, PlistBuddy
EventType14eq 12, in 2exec, extended_attributes_delete, ProcessRollup2, cs_invalidated, exec_event
CommandLine9contains 9root, -FilePath , nc, */etc/sysctl.conf*, */etc/sysctl.d/*
process.args9eq 7, in 3, contains 2, ends_with 2, regex_match 1, wildcard 1*--write*, *-w*, *=*, *com.apple.quarantine*, *com.apple.tccd
EventID8eq 7, in 123, 26, 400, 4103, 4104
OriginalFileName6eq 6popupwrapper.exe, BOINC.exe, CERTMGT.EXE, CertUtil.exe, bcdedit.exe
Details5contains 2, eq 2, ends_with 1(Empty), *.dll, .dll, 0, 0x00000000
ScriptBlockText5contains 5-ImagePath , ):\, -Path , .DriveLetter, 884e2002-217d-11da-b2a4-000e7bbb2b09
TargetFilename5ends_with 2, regex_match 1, starts_with 1, wildcard 1(?i)\x5cDevice\x5cCdRom, *.exe:Zone.Identifier, *.exe:Zone.Identifier:$DATA, *.msi:Zone.Identifier, *:Zone.Identifier
TargetObject5contains 3, wildcard 2, ends_with 1*\SOFTWARE\Microsoft\Cryptography\OID\EncodingType..., *\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPo..., *\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\Encodin..., HKLM\Software\Microsoft\SystemCertificates\AuthRoot\Certi..., HKLM\Software\Microsoft\SystemCertificates\Root\Certifica...
registry_value_name5eq 4, in 1Blob, Dll, $DLL, $Dll, BehaviorOnFailedVerify
ParentImage4ends_with 2, eq 1, is_not_null 1, /Script Editor, /System/Applications/Utilities/Script..., \RazerInstaller.exe
process.code_signature.exists4eq 3, is_not_null 1false,

Top indicator values (3604 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
event.typeeq
start
101036
event.typeeq
change
389
event.typeeq
deletion
216
EventTypeeq
exec
6547
EventTypeeq
extended_attributes_delete
33
process.argseq
-c
491
process.code_signature.existseq
false
3118
process.code_signature.trustedeq
false
3114
CommandLinecontains
*com.apple.quarantine*
22
CommandLinecontains
root
23
EventTypein
exec
2180
Flagseq
8388608
22
HasFullTrusteq
true
22
Imageends_with
/xattr
22
Imageends_with
\certutil.exe
243
Imageis_not_null
2155
OriginalFileNameeq
popupwrapper.exe
22
ScriptBlockTextcontains
-ImagePath
22
ScriptBlockTextcontains
Mount-DiskImage
22
TargetObjectcontains
\SOFTWARE\Microsoft\Cryptography\OID\EncodingType
22
TargetObjectcontains
\SOFTWARE\Microsoft\Cryptography\Providers\
22
TargetObjectcontains
\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType
22
TargetObjectcontains
\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\
22
event.typein
process_started
239
event.typein
start
240
parent_process_basenamewildcard
Python*
220
parent_process_basenamewildcard
bash
214
parent_process_basenamewildcard
osascript
212
parent_process_basenamewildcard
sh
214
parent_process_basenamewildcard
zsh
214

Exclusions (285 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
Detailseq
mso.dll
2
Imagewildcard
?:\Windows\CCM\CcmExec.exe
2
process.Ext.effective_parent.executablein
/Applications/iTerm.app/Contents/MacOS/iTerm2
2
process.code_signature.trustedeq
true
2
CallingProcessstarts_with
svchost.exe,AppReadiness
1
CallingProcessstarts_with
sysprep.exe
1
CommandLinecontains
*drop_caches*
1
CurrentDirectoryeq
/var/lib/rancher
1
DestinationPortin
22
1
DestinationPortin
25
1
DestinationPortin
443
1
DestinationPortin
465
1
DestinationPortin
53
1
DestinationPortin
587
1
DestinationPortin
80
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 28 rules

Elastic 25 rules

Splunk 13 rules

Kusto 1 rule

Panther 1 rule