ATT&CK Reference
Portfolio

TA0005 · DEFENSE EVASION

Subvert Trust Controls

T1553Windows · macOS · Linuxattack.mitre.org

Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs.

Detect it with

Collect and analyze signing certificate metadata on software that executes within the environment to look for unusual certificate characteristics and outliers.

Why it matters on shift

Subvert Trust Controls is one of the concrete ways adversaries achieve defense evasion. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.

What to look for next

After defense evasion, the next tactic is usually Credential Access. Search your telemetry for the transition before closing the ticket.

6 sub-techniques

How it shows up in practice

  1. T1553.001

    Gatekeeper Bypass

    Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs.

  2. T1553.002

    Code Signing

    Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with.

  3. T1553.003

    SIP and Trust Provider Hijacking

    Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks.

  4. T1553.004

    Install Root Certificate

    Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA).

  5. T1553.005

    Mark-of-the-Web Bypass

    Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls.

  6. T1553.006

    Code Signing Policy Modification

    Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. Code signing provides a level of authenticity on a program from a developer and a guarantee that the program has not been tampered with.

Kill-chain context

← beforePrivilege EscalationDefense Evasionafter →Credential Access