T1553 Subvert Trust Controls
EnterpriseAdversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site. Adversaries may attempt to subvert these trust mechanisms. The method adversaries use will depend on the specific mechanism they seek to subvert. Adversaries may conduct File and Directory Permissions Modification or Modify Registry in support of subverting these controls. Adversaries may also create or steal code signing certificates to acquire trust on target systems.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-techniques (6)
More specific entries beneath this one.
mitigations
ATT&CK mitigations that reduce this.
detected by (5)
Data components that detect this.
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.PSPlatform Securitystrong · backed by 12 of 20 mapped controls
- DE.CMContinuous Monitoringmoderate · backed by 7 of 20 mapped controls
- ID.RARisk Assessmentmoderate · backed by 6 of 20 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (20)
Security controls that mitigate this.
groups (1)
Threat groups associated with this.
software (1)
Malware and tools associated with this.
Detected by (Sigma) (4)
Sigma detection rules related to this.
source
Where this definition is published.