Detect Subvert Trust Controls in Splunk
Adversaries may undermine security controls that warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products contain mechanisms to identify programs or websites as possessing some level of trust, such as code signing certificates, Mark-of-the-Web (MOTW) attributes, Gatekeeper on macOS, or SIP and Trust Provider validation on Windows. Adversaries attempt to subvert these trust mechanisms through techniques including code signing certificate theft or forgery, MOTW removal, root certificate installation, SIP/Trust Provider hijacking, and Gatekeeper bypass. The method used depends on the specific mechanism being subverted.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1553 Subvert Trust Controls
- Canonical reference
- https://attack.mitre.org/techniques/T1553/
SPL Detection Query
index=wineventlog
(sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security")
| eval EventCode=coalesce(EventCode, event_id)
| eval Image=coalesce(Image, NewProcessName)
| eval CommandLine=coalesce(CommandLine, Process_Command_Line)
| eval ParentImage=coalesce(ParentImage, ParentProcessName)
| eval User=coalesce(User, SubjectUserName)
| eval CommandLineLower=lower(CommandLine)
| eval ImageLower=lower(Image)
```
``` Branch 1 — certutil certificate store manipulation
| eval CertStoreManip=if(
match(ImageLower, "certutil\.exe") AND match(CommandLineLower, "(-addstore|-delstore|-importpfx|-enterprise)"),
1, 0)
| eval RootStoreAdd=if(
CertStoreManip=1 AND match(CommandLineLower, "(root|authroot|trustedpublisher|trustedpeople)"),
1, 0)
``` Branch 2 — MOTW removal
| eval MotwRemoval=if(
match(CommandLineLower, "(unblock-file|zone\.identifier)") AND match(CommandLineLower, "(del |remove|erase|set-content|stream)"),
1, 0)
| eval UnblockFile=if(
match(CommandLineLower, "unblock-file"),
1, 0)
``` Branch 3 — suspicious signtool usage
| eval SigntoolUsage=if(
match(ImageLower, "signtool\.exe") AND match(CommandLineLower, "sign"),
1, 0)
``` Branch 4 — makecert or pvk2pfx usage (certificate creation)
| eval CertCreation=if(
match(ImageLower, "(makecert\.exe|pvk2pfx\.exe)"),
1, 0)
| eval SuspicionScore=CertStoreManip + RootStoreAdd + MotwRemoval + UnblockFile + SigntoolUsage + CertCreation
| where SuspicionScore > 0
| eval DetectionBranch=case(
RootStoreAdd=1, "ROOT_CERT_INSTALL",
CertStoreManip=1, "CERT_STORE_MANIP",
MotwRemoval=1, "MOTW_REMOVAL",
UnblockFile=1, "UNBLOCK_FILE",
SigntoolUsage=1, "SIGNTOOL_SIGN",
CertCreation=1, "CERT_CREATION",
true(), "TRUST_SUBVERSION")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine,
DetectionBranch, CertStoreManip, RootStoreAdd, MotwRemoval, UnblockFile,
SigntoolUsage, CertCreation, SuspicionScore
| sort - SuspicionScore, - _timeDetects trust control subversion attempts using Sysmon Event ID 1 (Process Creation) and Windows Security Event ID 4688. Evaluates four detection branches: certificate store manipulation via certutil, MOTW removal through Unblock-File or Zone.Identifier deletion, signtool signing operations, and certificate creation utilities. Assigns a cumulative suspicion score per event; ROOT store additions receive the highest weighting as they are rarely legitimate outside enterprise PKI operations.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Enterprise PKI administrators adding internal CA certificates via certutil -addstore ROOT
- Build pipelines using signtool.exe for legitimate application code signing
- IT helpdesk using Unblock-File to unblock files downloaded from internal SharePoint or file shares
- MDM and Group Policy certificate deployment operations
- Security software installation modifying cryptographic provider registry keys
Other platforms for T1553
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Add Self-Signed Root Certificate to Windows ROOT Store
Expected signal: Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-addstore ROOT'. Security Event ID 4688 (if command line auditing enabled). Windows CertificateServicesClient-Lifecycle-System/Operational Event ID 1001 (certificate installed). CAPI2 Operational log entries for certificate store modification.
- Test 2Remove Mark-of-the-Web via PowerShell Unblock-File
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'Unblock-File' and the target file path. Sysmon Event ID 23 or 26 (File Delete) for the Zone.Identifier ADS removal. PowerShell ScriptBlock Log Event ID 4104 showing the Unblock-File command. Security Event ID 4663 (object access) if file system auditing is enabled for the temp directory.
- Test 3Remove Zone.Identifier ADS via cmd.exe del command
Expected signal: Sysmon Event ID 1: cmd.exe with CommandLine containing 'Zone.Identifier' and 'del'. Sysmon Event ID 23 (File Delete) for the ADS. Security Event ID 4688 if command line auditing is enabled. Note: some EDR solutions specifically monitor for ADS deletion on .exe files.
- Test 4Inspect and Enumerate SIP Trust Provider Registry Keys
Expected signal: Sysmon Event ID 1: reg.exe with CommandLine querying Cryptography\OID paths. Security Event ID 4663 (registry object access) if registry auditing is enabled. No modifications occur — this tests detection of enumeration prior to hijacking.
References (9)
- https://attack.mitre.org/techniques/T1553/
- https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf
- https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec
- https://securelist.com/why-you-shouldnt-completely-trust-files-signed-with-digital-certificates/68593/
- https://learn.microsoft.com/en-us/windows/win32/seccrypto/subject-interface-packages
- https://learn.microsoft.com/en-us/sysinternals/downloads/streams
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceregistryevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553/T1553.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry
Unlock Pro Content
Get the full detection package for T1553 including response playbook, investigation guide, and atomic red team tests.