MITRE ATT&CKtechnique

T1553 Subvert Trust Controls

Published 2020-02-05 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Defense Impairment
Platforms
Linux, macOS, Windows
Version
2.0
Created
2020-02-05

Description

Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site. Adversaries may attempt to subvert these trust mechanisms. The method adversaries use will depend on the specific mechanism they seek to subvert. Adversaries may conduct File and Directory Permissions Modification or Modify Registry in support of subverting these controls. Adversaries may also create or steal code signing certificates to acquire trust on target systems.

Related

Tactic · MITRE ATT&CK (1)

  • TA0112 Defense Impairment tactic

Referenced by MITRE ATT&CK · mitigates (5)

  • M1054 Software Configuration mitigation
  • M1038 Execution Prevention mitigation
  • M1024 Restrict Registry Permissions mitigation
  • M1026 Privileged Account Management mitigation
  • M1028 Operating System Configuration mitigation

Referenced by MITRE ATT&CK · subtechnique of (6)

  • T1553.006 Code Signing Policy Modification sub-technique
  • T1553.005 Mark-of-the-Web Bypass sub-technique
  • T1553.004 Install Root Certificate sub-technique
  • T1553.001 Gatekeeper Bypass sub-technique
  • T1553.002 Code Signing sub-technique
  • T1553.003 SIP and Trust Provider Hijacking sub-technique

Referenced by MITRE ATT&CK · uses (2)

  • S9008 Shai-Hulud software (malware)
  • G0001 Axiom group

Referenced by Compliance · mitigates (20)

  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-10 Software Usage Restrictions NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-3 Configuration Change Control NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-IA-7 Cryptographic Module Authentication NIST 800-53 control
  • NIST-IA-9 Service Identification and Authentication NIST 800-53 control
  • NIST-RA-9 Criticality Analysis NIST 800-53 control
  • NIST-SA-10 Developer Configuration Management NIST 800-53 control
  • NIST-SA-11 Developer Testing and Evaluation NIST 800-53 control
  • NIST-SC-34 Non-modifiable Executable Programs NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References