T1553 Subvert Trust Controls
Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate,…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Cisco Crypto Commandshightest · cisco
- Root Certificate Installed From Susp Locationshightest · windows
- Suspicious RazerInstaller Explorer Subprocesshightest · windows
- Kapeka Backdoor Configuration Persistencemediumtest · windows
- New Root Certificate Installed Via CertMgr.EXEmediumtest · windows
- New Root Certificate Installed Via Certutil.EXEmediumtest · windows
- Persistence Via New SIP Providermediumtest · windows
- Potential Secure Deletion with SDeletemediumtest · windows
- Renamed BOINC Client Executionmediumtest · windows
- Root Certificate Installed - PowerShellmediumtest · windows
- Suspicious Execution via macOS Script Editormediumtest · macos
- Suspicious Invoke-Item From Mount-DiskImagemediumtest · windows
- Suspicious Package Installed - Linuxmediumtest · linux
- Suspicious Unblock-Filemediumtest · windows
- Suspicious X509Enrollment - Process Creationmediumtest · windows
- Suspicious X509Enrollment - Ps Scriptmediumtest · windows
- Windows AppX Deployment Full Trust Package Installationmediumexperimental · windows
- Windows AppX Deployment Unsigned Package Installationmediumexperimental · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.