Subvert Trust Controls

let SuspiciousCertOps = dynamic(["certutil", "certmgr", "certreq", "makecert", "pvk2pfx", "signtool"]);
let RootCertPaths = dynamic(["ROOT", "TRUSTEDPUBLISHER", "TRUSTEDPEOPLE", "AUTHROOT"]);
let MotwRemovalPatterns = dynamic(["Zone.Identifier", ":Zone.Identifier", "Unblock-File", "ZoneId"]);
// Branch 1: Certificate store manipulation via certutil
let CertutilOps = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "certutil.exe"
| where ProcessCommandLine has_any ("-addstore", "-delstore", "-importpfx", "-user -addstore", "-enterprise", "-f -addstore")
| extend DetectionBranch = "CertStore_Manipulation"
| extend SuspicionScore = case(
    ProcessCommandLine has "-addstore" and ProcessCommandLine has_any ("ROOT", "AUTHROOT", "TRUSTEDPUBLISHER"), 3,
    ProcessCommandLine has "-importpfx", 2,
    ProcessCommandLine has "-addstore", 1,
    1);
// Branch 2: MOTW removal or ADS deletion
let MotwRemoval = DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "powershell.exe" or FileName =~ "pwsh.exe" or FileName =~ "cmd.exe")
| where ProcessCommandLine has_any (MotwRemovalPatterns)
| extend DetectionBranch = "MOTW_Removal"
| extend SuspicionScore = case(
    ProcessCommandLine has "Unblock-File", 2,
    ProcessCommandLine has "Zone.Identifier" and ProcessCommandLine has_any ("del", "remove", "erase", "Set-Content"), 3,
    1);
// Branch 3: Registry modifications to trust providers or authenticode
let TrustRegistryMod = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has_any (
    "SOFTWARE\\Microsoft\\Cryptography\\OID",
    "SOFTWARE\\Microsoft\\Cryptography\\Providers",
    "SOFTWARE\\Policies\\Microsoft\\SystemCertificates",
    "SOFTWARE\\Microsoft\\EnterpriseCertificates",
    "SYSTEM\\CurrentControlSet\\Control\\SecurityProviders"
  )
| where ActionType in~ ("RegistryValueSet", "RegistryKeyCreated")
| extend DetectionBranch = "Trust_Registry_Modification"
| extend SuspicionScore = 2
| project Timestamp, DeviceName, AccountName,
    FileName = InitiatingProcessFileName,
    ProcessCommandLine = InitiatingProcessCommandLine,
    InitiatingProcessFileName, InitiatingProcessCommandLine,
    DetectionBranch, SuspicionScore;
// Branch 4: Signed binary proxy / catalog hijacking
let SigToolUsage = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "signtool.exe"
| extend DetectionBranch = "Signtool_Usage"
| extend SuspicionScore = case(
    ProcessCommandLine has "sign" and ProcessCommandLine has "/fd", 2,
    1);
// Union all branches
let ProcessAlerts = union CertutilOps, MotwRemoval, SigToolUsage
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         DetectionBranch, SuspicionScore;
union ProcessAlerts, TrustRegistryMod
| where SuspicionScore >= 1
| sort by SuspicionScore desc, Timestamp desc

index=wineventlog
(sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security")
| eval EventCode=coalesce(EventCode, event_id)
| eval Image=coalesce(Image, NewProcessName)
| eval CommandLine=coalesce(CommandLine, Process_Command_Line)
| eval ParentImage=coalesce(ParentImage, ParentProcessName)
| eval User=coalesce(User, SubjectUserName)
| eval CommandLineLower=lower(CommandLine)
| eval ImageLower=lower(Image)
```
``` Branch 1 — certutil certificate store manipulation
| eval CertStoreManip=if(
    match(ImageLower, "certutil\.exe") AND match(CommandLineLower, "(-addstore|-delstore|-importpfx|-enterprise)"),
    1, 0)
| eval RootStoreAdd=if(
    CertStoreManip=1 AND match(CommandLineLower, "(root|authroot|trustedpublisher|trustedpeople)"),
    1, 0)
``` Branch 2 — MOTW removal
| eval MotwRemoval=if(
    match(CommandLineLower, "(unblock-file|zone\.identifier)") AND match(CommandLineLower, "(del |remove|erase|set-content|stream)"),
    1, 0)
| eval UnblockFile=if(
    match(CommandLineLower, "unblock-file"),
    1, 0)
``` Branch 3 — suspicious signtool usage
| eval SigntoolUsage=if(
    match(ImageLower, "signtool\.exe") AND match(CommandLineLower, "sign"),
    1, 0)
``` Branch 4 — makecert or pvk2pfx usage (certificate creation)
| eval CertCreation=if(
    match(ImageLower, "(makecert\.exe|pvk2pfx\.exe)"),
    1, 0)
| eval SuspicionScore=CertStoreManip + RootStoreAdd + MotwRemoval + UnblockFile + SigntoolUsage + CertCreation
| where SuspicionScore > 0
| eval DetectionBranch=case(
    RootStoreAdd=1, "ROOT_CERT_INSTALL",
    CertStoreManip=1, "CERT_STORE_MANIP",
    MotwRemoval=1, "MOTW_REMOVAL",
    UnblockFile=1, "UNBLOCK_FILE",
    SigntoolUsage=1, "SIGNTOOL_SIGN",
    CertCreation=1, "CERT_CREATION",
    true(), "TRUST_SUBVERSION")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine,
        DetectionBranch, CertStoreManip, RootStoreAdd, MotwRemoval, UnblockFile,
        SigntoolUsage, CertCreation, SuspicionScore
| sort - SuspicionScore, - _time

any where
  (
    event.category == "process" and event.type == "start" and
    (
      (
        process.name == "certutil.exe" and
        process.command_line : ("*-addstore*", "*-delstore*", "*-importpfx*", "*-enterprise*")
      ) or
      (
        process.name in~ ("powershell.exe", "pwsh.exe", "cmd.exe") and
        process.command_line : ("*Zone.Identifier*", "*Unblock-File*", "*ZoneId*")
      ) or
      (
        process.name == "signtool.exe" and
        process.command_line : "*sign*"
      ) or
      process.name in~ ("makecert.exe", "pvk2pfx.exe")
    )
  ) or
  (
    event.category == "registry" and
    event.type in ("creation", "change") and
    registry.path : (
      "*SOFTWARE\\Microsoft\\Cryptography\\OID*",
      "*SOFTWARE\\Microsoft\\Cryptography\\Providers*",
      "*SOFTWARE\\Policies\\Microsoft\\SystemCertificates*",
      "*SOFTWARE\\Microsoft\\EnterpriseCertificates*",
      "*SYSTEM\\CurrentControlSet\\Control\\SecurityProviders*"
    )
  )

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  LOGSOURCENAME(logsourceid) AS LogSource,
  sourceip AS SourceIP,
  username AS Username,
  "Process Name",
  "Command Line",
  "Parent Process Name",
  CASE
    WHEN LOWER("Process Name") LIKE '%certutil.exe%'
         AND (LOWER("Command Line") LIKE '%-addstore%' OR LOWER("Command Line") LIKE '%-delstore%'
              OR LOWER("Command Line") LIKE '%-importpfx%' OR LOWER("Command Line") LIKE '%-enterprise%')
         AND (LOWER("Command Line") LIKE '%root%' OR LOWER("Command Line") LIKE '%authroot%'
              OR LOWER("Command Line") LIKE '%trustedpublisher%')
      THEN 'ROOT_CERT_INSTALL'
    WHEN LOWER("Process Name") LIKE '%certutil.exe%'
         AND (LOWER("Command Line") LIKE '%-addstore%' OR LOWER("Command Line") LIKE '%-importpfx%')
      THEN 'CERT_STORE_MANIP'
    WHEN (LOWER("Process Name") LIKE '%powershell%' OR LOWER("Process Name") LIKE '%cmd.exe%'
          OR LOWER("Process Name") LIKE '%pwsh.exe%')
         AND (LOWER("Command Line") LIKE '%zone.identifier%' OR LOWER("Command Line") LIKE '%unblock-file%')
      THEN 'MOTW_REMOVAL'
    WHEN LOWER("Process Name") LIKE '%signtool.exe%' AND LOWER("Command Line") LIKE '%sign%'
      THEN 'SIGNTOOL_SIGN'
    WHEN LOWER("Process Name") LIKE '%makecert.exe%' OR LOWER("Process Name") LIKE '%pvk2pfx.exe%'
      THEN 'CERT_CREATION'
    ELSE 'TRUST_SUBVERSION'
  END AS DetectionBranch
FROM events
WHERE LOGSOURCETYPEID IN (12, 119)
  AND (
    (
      LOWER("Process Name") LIKE '%certutil.exe%' AND
      (
        LOWER("Command Line") LIKE '%-addstore%' OR
        LOWER("Command Line") LIKE '%-delstore%' OR
        LOWER("Command Line") LIKE '%-importpfx%' OR
        LOWER("Command Line") LIKE '%-enterprise%'
      )
    ) OR
    (
      (
        LOWER("Process Name") LIKE '%powershell%' OR
        LOWER("Process Name") LIKE '%cmd.exe%' OR
        LOWER("Process Name") LIKE '%pwsh.exe%'
      ) AND
      (
        LOWER("Command Line") LIKE '%zone.identifier%' OR
        LOWER("Command Line") LIKE '%unblock-file%' OR
        LOWER("Command Line") LIKE '%zoneid%'
      )
    ) OR
    (
      LOWER("Process Name") LIKE '%signtool.exe%' AND
      LOWER("Command Line") LIKE '%sign%'
    ) OR
    LOWER("Process Name") LIKE '%makecert.exe%' OR
    LOWER("Process Name") LIKE '%pvk2pfx.exe%'
  )
LAST 24 HOURS
ORDER BY starttime DESC

_index=sec_record*
| where metadata_deviceEventId in ("1", "4688")
| where (
    (toLowerCase(baseImage) matches ".*certutil\\.exe.*" AND
     toLowerCase(commandLine) matches ".*(-addstore|-delstore|-importpfx|-enterprise).*")
    OR (toLowerCase(baseImage) matches ".*(powershell|pwsh|cmd)\\.exe.*" AND
        toLowerCase(commandLine) matches ".*(zone\\.identifier|unblock-file|zoneid).*")
    OR (toLowerCase(baseImage) matches ".*signtool\\.exe.*" AND
        toLowerCase(commandLine) matches ".*sign.*")
    OR toLowerCase(baseImage) matches ".*(makecert|pvk2pfx)\\.exe.*"
  )
| eval ImageLower = toLowerCase(baseImage)
| eval CmdLower = toLowerCase(commandLine)
| eval CertStoreManip = if (ImageLower matches ".*certutil\\.exe.*" AND (CmdLower matches ".*-addstore.*" OR CmdLower matches ".*-delstore.*" OR CmdLower matches ".*-importpfx.*" OR CmdLower matches ".*-enterprise.*"), 1, 0)
| eval RootStoreAdd = if (CertStoreManip == 1 AND (CmdLower matches ".*(root|authroot|trustedpublisher|trustedpeople).*"), 1, 0)
| eval MotwRemoval = if (ImageLower matches ".*(powershell|pwsh|cmd)\\.exe.*" AND (CmdLower matches ".*zone\\.identifier.*" OR CmdLower matches ".*unblock-file.*"), 1, 0)
| eval SigntoolUsage = if (ImageLower matches ".*signtool\\.exe.*" AND CmdLower matches ".*sign.*", 1, 0)
| eval CertCreation = if (ImageLower matches ".*(makecert|pvk2pfx)\\.exe.*", 1, 0)
| eval SuspicionScore = CertStoreManip + RootStoreAdd + MotwRemoval + SigntoolUsage + CertCreation
| eval DetectionBranch = if (RootStoreAdd == 1, "ROOT_CERT_INSTALL", if (CertStoreManip == 1, "CERT_STORE_MANIP", if (MotwRemoval == 1, "MOTW_REMOVAL", if (SigntoolUsage == 1, "SIGNTOOL_SIGN", if (CertCreation == 1, "CERT_CREATION", "TRUST_SUBVERSION")))))
| fields metadata_deviceTimestamp, device_hostname, user_username, baseImage, commandLine, parentBaseImage, DetectionBranch, CertStoreManip, RootStoreAdd, MotwRemoval, SigntoolUsage, CertCreation, SuspicionScore
| sort by SuspicionScore desc, metadata_deviceTimestamp desc

rule t1553_subvert_trust_controls {
  meta:
    author = "Detection Engineering"
    description = "Detects T1553 Subvert Trust Controls: certutil certificate store manipulation, MOTW removal via Zone.Identifier or Unblock-File, signtool signing, certificate creation tools, and trust provider registry modifications"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1553"
    reference = "https://attack.mitre.org/techniques/T1553/"
    severity = "HIGH"
    priority = "HIGH"

  events:
    (
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      (
        (
          re.regex($e.target.process.file.full_path, `(?i)certutil\.exe$`) and
          re.regex($e.target.process.command_line, `(?i)(-addstore|-delstore|-importpfx|-enterprise)`)
        ) or
        (
          re.regex($e.target.process.file.full_path, `(?i)(powershell|pwsh|cmd)\.exe$`) and
          re.regex($e.target.process.command_line, `(?i)(unblock-file|zone\.identifier|zoneid)`)
        ) or
        (
          re.regex($e.target.process.file.full_path, `(?i)signtool\.exe$`) and
          re.regex($e.target.process.command_line, `(?i)\bsign\b`)
        ) or
        re.regex($e.target.process.file.full_path, `(?i)(makecert|pvk2pfx)\.exe$`)
      )
    ) or
    (
      $e.metadata.event_type = "REGISTRY_MODIFICATION" and
      re.regex($e.target.registry.registry_key,
        `(?i)(SOFTWARE.Microsoft.Cryptography.(OID|Providers)|SOFTWARE.(Policies.Microsoft.SystemCertificates|Microsoft.EnterpriseCertificates)|SYSTEM.CurrentControlSet.Control.SecurityProviders)`
      )
    )

  condition:
    $e
}

#event_simpleName=ProcessRollup2
| eval ImageLower=lower(ImageFileName)
| eval CmdLower=lower(CommandLine)
| eval isCertutil=if(
    match(field=ImageLower, regex="certutil\\.exe") AND
    match(field=CmdLower, regex="(-addstore|-delstore|-importpfx|-enterprise)"),
    1, 0)
| eval isRootStore=if(
    isCertutil==1 AND
    match(field=CmdLower, regex="(root|authroot|trustedpublisher|trustedpeople)"),
    1, 0)
| eval isMotwRemoval=if(
    match(field=ImageLower, regex="(powershell|pwsh|cmd)\\.exe") AND
    match(field=CmdLower, regex="(unblock-file|zone\\.identifier|zoneid)"),
    1, 0)
| eval isSigntool=if(
    match(field=ImageLower, regex="signtool\\.exe") AND
    match(field=CmdLower, regex="\\bsign\\b"),
    1, 0)
| eval isCertCreation=if(
    match(field=ImageLower, regex="(makecert|pvk2pfx)\\.exe"),
    1, 0)
| eval SuspicionScore=isCertutil + isRootStore + isMotwRemoval + isSigntool + isCertCreation
| where SuspicionScore > 0
| eval DetectionBranch=case(
    isRootStore==1, "ROOT_CERT_INSTALL",
    isCertutil==1, "CERT_STORE_MANIP",
    isMotwRemoval==1, "MOTW_REMOVAL",
    isSigntool==1, "SIGNTOOL_SIGN",
    isCertCreation==1, "CERT_CREATION",
    "TRUST_SUBVERSION")
| table([timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine, DetectionBranch, SuspicionScore])
| sort(field=SuspicionScore, order=desc)