Operating systems and security products try to tell you what to trust. A program runs because it carries a valid code signing certificate. A file triggers a warning because it came from the internet. A browser complains about an unknown site. MITRE ATT&CK groups attacks on these mechanisms under Subvert Trust Controls, technique T1553. The tactic is defense impairment, and it applies to Linux, macOS and Windows.
How attackers use it
The method depends on the mechanism being targeted. MITRE notes that adversaries may use File and Directory Permissions Modification or Modify Registry to support the attack, and may also create or steal code signing certificates to gain trust on target systems.
T1553 is a parent technique with six sub-techniques, each covering one trust mechanism:
- Gatekeeper Bypass (T1553.001) on macOS
- Code Signing (T1553.002)
- SIP and Trust Provider Hijacking (T1553.003) on Windows
- Install Root Certificate (T1553.004)
- Mark-of-the-Web Bypass (T1553.005) on Windows
- Code Signing Policy Modification (T1553.006)
The common thread is that the attacker does not break the control by force. They make the system believe the malicious thing is trustworthy, or they turn the warning off.
How to detect it
MITRE does not list data sources on this parent page, so detection is built from the sub-techniques. The signals that carry across them:
- Changes to certificate stores, especially new root certificates.
- Registry writes under keys that govern signature validation and certificate policy.
- Permission changes on files and registry hives that hold trust settings.
- Signed binaries from publishers or certificates you have never seen in your environment.
Keep a baseline of your trusted root certificates and your application control policy. A change against that baseline is the cheapest high signal you can get.
How to reduce the risk
MITRE lists these mitigations for the parent technique.
- Execution prevention. On macOS, system settings can prevent applications that were not downloaded through the Apple Store from running. On Windows, enable application control such as AppLocker or Device Guard to block malicious content from loading.
- Operating system configuration. Windows Group Policy can manage root certificates. Setting the
Flagsvalue ofHKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRootsto 1 stops non-administrators from installing roots into their own HKCU store. - Privileged account management. Control the creation, modification, use and permissions of privileged accounts, including SYSTEM and root.
- Restrict registry permissions. Set proper permissions on registry hives so users cannot modify keys related to SIP and trust provider components.
- Software configuration. MITRE mentions HTTP Public Key Pinning as one method against adversary in the middle situations that use a fraudulent certificate. Note that HPKP is a historical browser feature, so treat the underlying idea, pinning the expected certificate, as the lesson.
Check your own environment
Read-only checks on Windows, run in PowerShell:
# List trusted root certificates in the machine store
Get-ChildItem Cert:\LocalMachine\Root | Select-Object Subject, Thumbprint, NotAfter
# Check whether the protected roots policy value is set
Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots" -ErrorAction SilentlyContinue
On macOS, spctl --status reports whether Gatekeeper assessments are enabled.
Quick check
Why are code signing certificates a target even though signing is meant to help defenders?
A valid signature earns trust. MITRE notes adversaries may create or steal code signing certificates to acquire that trust on target systems.
What does setting the ProtectedRoots Flags value to 1 do?
It prevents non-administrator users from making further root installations into their own HKCU certificate store.
