Which SIEM platforms have a T1553 detection rule?

df00tech provides T1553 (Subvert Trust Controls) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Subvert Trust Controls (T1553)?

Detecting Subvert Trust Controls requires the following data sources: Process: Process Creation, Command: Command Execution, Windows Registry: Registry Key Modification, Microsoft Defender for Endpoint.

What severity and confidence is the T1553 detection?

The T1553 detection is rated high severity with medium confidence.

What are common false positives for T1553?

Common false positives for T1553 include: Enterprise PKI administrators legitimately adding internal CA certificates to ROOT or TRUSTEDPUBLISHER stores via certutil; Software developers using signtool.exe to sign their own applications during build processes; IT administrators using Unblock-File or removing Zone.Identifier from files downloaded from trusted internal shares.

T1553 IBM QRadar · QRadar

Detect Subvert Trust Controls in IBM QRadar

Adversaries may undermine security controls that warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products contain mechanisms to identify programs or websites as possessing some level of trust, such as code signing certificates, Mark-of-the-Web (MOTW) attributes, Gatekeeper on macOS, or SIP and Trust Provider validation on Windows. Adversaries attempt to subvert these trust mechanisms through techniques including code signing certificate theft or forgery, MOTW removal, root certificate installation, SIP/Trust Provider hijacking, and Gatekeeper bypass. The method used depends on the specific mechanism being subverted.

MITRE ATT&CK

Tactic: Defense Evasion
Technique: T1553 Subvert Trust Controls
Canonical reference: https://attack.mitre.org/techniques/T1553/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  LOGSOURCENAME(logsourceid) AS LogSource,
  sourceip AS SourceIP,
  username AS Username,
  "Process Name",
  "Command Line",
  "Parent Process Name",
  CASE
    WHEN LOWER("Process Name") LIKE '%certutil.exe%'
         AND (LOWER("Command Line") LIKE '%-addstore%' OR LOWER("Command Line") LIKE '%-delstore%'
              OR LOWER("Command Line") LIKE '%-importpfx%' OR LOWER("Command Line") LIKE '%-enterprise%')
         AND (LOWER("Command Line") LIKE '%root%' OR LOWER("Command Line") LIKE '%authroot%'
              OR LOWER("Command Line") LIKE '%trustedpublisher%')
      THEN 'ROOT_CERT_INSTALL'
    WHEN LOWER("Process Name") LIKE '%certutil.exe%'
         AND (LOWER("Command Line") LIKE '%-addstore%' OR LOWER("Command Line") LIKE '%-importpfx%')
      THEN 'CERT_STORE_MANIP'
    WHEN (LOWER("Process Name") LIKE '%powershell%' OR LOWER("Process Name") LIKE '%cmd.exe%'
          OR LOWER("Process Name") LIKE '%pwsh.exe%')
         AND (LOWER("Command Line") LIKE '%zone.identifier%' OR LOWER("Command Line") LIKE '%unblock-file%')
      THEN 'MOTW_REMOVAL'
    WHEN LOWER("Process Name") LIKE '%signtool.exe%' AND LOWER("Command Line") LIKE '%sign%'
      THEN 'SIGNTOOL_SIGN'
    WHEN LOWER("Process Name") LIKE '%makecert.exe%' OR LOWER("Process Name") LIKE '%pvk2pfx.exe%'
      THEN 'CERT_CREATION'
    ELSE 'TRUST_SUBVERSION'
  END AS DetectionBranch
FROM events
WHERE LOGSOURCETYPEID IN (12, 119)
  AND (
    (
      LOWER("Process Name") LIKE '%certutil.exe%' AND
      (
        LOWER("Command Line") LIKE '%-addstore%' OR
        LOWER("Command Line") LIKE '%-delstore%' OR
        LOWER("Command Line") LIKE '%-importpfx%' OR
        LOWER("Command Line") LIKE '%-enterprise%'
      )
    ) OR
    (
      (
        LOWER("Process Name") LIKE '%powershell%' OR
        LOWER("Process Name") LIKE '%cmd.exe%' OR
        LOWER("Process Name") LIKE '%pwsh.exe%'
      ) AND
      (
        LOWER("Command Line") LIKE '%zone.identifier%' OR
        LOWER("Command Line") LIKE '%unblock-file%' OR
        LOWER("Command Line") LIKE '%zoneid%'
      )
    ) OR
    (
      LOWER("Process Name") LIKE '%signtool.exe%' AND
      LOWER("Command Line") LIKE '%sign%'
    ) OR
    LOWER("Process Name") LIKE '%makecert.exe%' OR
    LOWER("Process Name") LIKE '%pvk2pfx.exe%'
  )
LAST 24 HOURS
ORDER BY starttime DESC

high severity medium confidence

IBM QRadar AQL query detecting T1553 Subvert Trust Controls. Targets Windows Security Event Log (LOGSOURCETYPEID 12, EventID 4688) and Sysmon (LOGSOURCETYPEID 119, EventID 1) process creation events. Detects certutil certificate store manipulation including root store additions, MOTW removal, signtool signing operations, and certificate creation utility usage. Requires custom QRadar DSM properties for Process Name and Command Line to be mapped from raw Windows event payloads.

Data Sources

Microsoft Windows Security Event Log (EventID 4688)Sysmon EventLog (EventID 1 - Process Create)

Required Tables

events

False Positives & Tuning

IT infrastructure teams distributing enterprise root CA certificates to endpoints via Group Policy or manual certutil operations will produce ROOT_CERT_INSTALL and CERT_STORE_MANIP events at scale across fleet-wide certificate rollout windows
Automated code signing systems and developer workstations with signtool integrated into build toolchains will generate high-volume SIGNTOOL_SIGN events during CI/CD pipeline execution on build servers
Legitimate software distribution platforms that download and execute installer packages may strip Zone.Identifier ADS streams in a preprocessing step before execution, triggering MOTW_REMOVAL detections at scale

Download portable Sigma rule (.yml)

Other platforms for T1553

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Add Self-Signed Root Certificate to Windows ROOT Store
Expected signal: Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-addstore ROOT'. Security Event ID 4688 (if command line auditing enabled). Windows CertificateServicesClient-Lifecycle-System/Operational Event ID 1001 (certificate installed). CAPI2 Operational log entries for certificate store modification.
Test 2Remove Mark-of-the-Web via PowerShell Unblock-File
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'Unblock-File' and the target file path. Sysmon Event ID 23 or 26 (File Delete) for the Zone.Identifier ADS removal. PowerShell ScriptBlock Log Event ID 4104 showing the Unblock-File command. Security Event ID 4663 (object access) if file system auditing is enabled for the temp directory.
Test 3Remove Zone.Identifier ADS via cmd.exe del command
Expected signal: Sysmon Event ID 1: cmd.exe with CommandLine containing 'Zone.Identifier' and 'del'. Sysmon Event ID 23 (File Delete) for the ADS. Security Event ID 4688 if command line auditing is enabled. Note: some EDR solutions specifically monitor for ADS deletion on .exe files.
Test 4Inspect and Enumerate SIP Trust Provider Registry Keys
Expected signal: Sysmon Event ID 1: reg.exe with CommandLine querying Cryptography\OID paths. Security Event ID 4663 (registry object access) if registry auditing is enabled. No modifications occur — this tests detection of enumeration prior to hijacking.

Last updated: 2026-04-13 Research depth: deep

References (9)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1553 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Related Detections

Sub-techniques (6)

Related Techniques

T1553.001Gatekeeper Bypass T1553.002Code Signing T1553.003SIP and Trust Provider Hijacking T1553.004Install Root Certificate T1553.005Mark-of-the-Web Bypass T1553.006Code Signing Policy Modification T1112Modify Registry T1222File and Directory Permissions Modification T1036Masquerading T1027Obfuscated Files or Information T1105Ingress Tool Transfer

Detect Subvert Trust Controls in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1553

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Sub-techniques (6)

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1553

Testing Methodology

Unlock Pro Content

Related Detections

Sub-techniques (6)

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

Get new detections in your inbox