Subvert Trust Controls T1553
Tactic: Defense Impairment
Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site.
Events covered
19 catalog events are tagged with this technique by at least one rule.
Authoring guide
Patterns shared across the 60 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (49 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (3538 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.
Exclusions (246 distinct)
Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 28 rules
- Active Directory Certificate Services Denied Certificate Enrollment Request
- Certutil root certificate installation
- Cisco Crypto Commands
- Gatekeeper Bypass via Xattr
- Install Root Certificate
- Kapeka Backdoor Configuration Persistence
- macOS Code Signature Invalidation
- macOS Gatekeeper User Override
- New Root Certificate Installed Via CertMgr.EXE
- New Root Certificate Installed Via Certutil.EXE
- Persistence Via New SIP Provider
- Potential BOINC Software Execution (UC-Berkeley Signature)
- Potential Secure Deletion with SDelete
- Renamed BOINC Client Execution
- Root Certificate Installed - PowerShell
- Root Certificate Installed From Susp Locations
- Suspicious Execution via macOS Script Editor
- Suspicious Invoke-Item From Mount-DiskImage
- Suspicious Mount-DiskImage
- Suspicious Package Installed - Linux
- Suspicious RazerInstaller Explorer Subprocess
- Suspicious SIP or trust provider registration
- Suspicious Unblock-File
- Suspicious X509Enrollment - Process Creation
- Suspicious X509Enrollment - Ps Script
- Windows AppX Deployment Full Trust Package Installation
- Windows AppX Deployment Unsigned Package Installation
- Windows MSIX Package Support Framework AI_STUBS Execution
Elastic 17 rules
- Attempt to Disable Gatekeeper
- Attempt to Install Root Certificate
- Code Signing Policy Modification Through Built-in tools
- Code Signing Policy Modification Through Registry
- Creation or Modification of Root Certificate
- Expired or Revoked Driver Loaded
- Gatekeeper Override and Execution
- Potential Masquerading as System32 DLL
- Potential Masquerading as System32 Executable
- Quarantine Attrib Removed by Unsigned or Untrusted Process
- Root Certificate Installation
- SIP Provider Modification
- SSL Certificate Deletion
- Suspicious Curl from macOS Application
- Suspicious Kernel Feature Activity
- Suspicious Outbound Network Connection via Unsigned Binary
- Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601 - CurveBall)
Splunk 13 rules
- Certutil Root Certificate Install (Windows Event Log)
- ISO Image Mounted - Windows (PowerShell)
- ISO Image Mounted - Windows (Windows Event Log)
- MacOS Gatekeeper Bypass
- Windows Advanced Installer MSIX with AI_STUBS Execution
- Windows AppX Deployment Full Trust Package Installation
- Windows AppX Deployment Unsigned Package Installation
- Windows Developer-Signed MSIX Package Installation
- Windows Mark Of The Web Bypass
- Windows Registry Certificate Added
- Windows Registry SIP Provider Modification
- Windows SIP Provider Inventory
- Windows SIP WinVerifyTrust Failed Trust Validation