{ "technique_id": "T1553", "name": "Subvert Trust Controls", "priority": "high", "status": "draft", "version": "0.1.0", "last_reviewed": "2026-07-23", "generated_by": "SOC Response Atlas by Basyrix", "tactics": [ "Defense Impairment" ], "platforms": [ "Linux", "macOS", "Windows" ], "summary": "Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust...", "soc_recommendation": "Investigate Subvert Trust Controls activity in the context of Defense Impairment: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.", "d3fend_mappings": [ { "id": "D3-CQ", "name": "Content Quarantine", "relationship": "isolate", "practical_action": "Apply Content Quarantine to contain the blast radius once this technique is observed.", "tooling": [ "Defender for Endpoint" ] }, { "id": "D3-RC", "name": "Restore Configuration", "relationship": "restore", "practical_action": "Use Restore Configuration to recover affected systems or data after containment.", "tooling": [ "Defender for Endpoint" ] }, { "id": "D3-CI", "name": "Configuration Inventory", "relationship": "model", "practical_action": "Use Configuration Inventory to establish a baseline that makes this technique's deviations easier to spot.", "tooling": [ "Defender for Endpoint" ] } ], "investigation_steps": { "microsoft": [ "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.", "Check Sentinel analytics rules and incidents correlated with this technique.", "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource." ], "generic": [ "Confirm whether the observed subvert trust controls activity matches expected administrative or application behaviour.", "Identify the host, account, or resource where the activity occurred and its business criticality.", "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.", "Real detection reference: \"CYFIRMA - Attack Surface - Weak Certificate Exposure - High Rule\" -- \"This alert indicates that a weak or insecure SSL/TLS certificate has been detected on a public-facing asset monitored by Cyfirma. Such certificates do not meet modern encryption standards and are considered insecure, especially for handling sensitive transactions. This exposure increases the risk of man-in-the-middle attacks and loss of data integrity or confidentiality. Immediate remediation is advised by replacing weak certificates with strong, industry-compliant ones.\"" ] }, "evidence_to_collect": [ "Host or resource affected", "Account or identity involved", "Timestamp of the activity", "Related process, file, or network artifact", "Any preceding or follow-on alerts" ], "response_actions": [ { "name": "Contain the affected host or account", "category": "Containment", "risk": "Medium", "automation_safe": false, "approval_required": true, "tool": "Defender for Endpoint / Entra ID", "notes": "Requires approval -- confirm malicious intent before isolating a host or disabling an account." }, { "name": "Collect and preserve evidence", "category": "Investigation", "risk": "Low", "automation_safe": true, "approval_required": false, "tool": "Defender for Endpoint", "notes": "Safe -- read-only evidence collection." } ], "queries": { "kql": [ { "name": "3b5a1c0e-7f3a-4d47-8416-6c0b8b91e9ce — CYFIRMA - Attack Surface - Weak Certificate Exposure - High Rule", "description": "\"This alert indicates that a weak or insecure SSL/TLS certificate has been detected on a public-facing asset monitored by Cyfirma. Such certificates do not meet modern encryption standards and are considered insecure, especially for handling sensitive transactions. This exposure increases the risk of man-in-the-middle attacks and loss of data integrity or confidentiality. Immediate remediation is advised by replacing weak certificates with strong, industry-compliant ones.\" (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)", "query": "// High Severity Weak Certificate Exposure Detected\nlet timeFrame = 5m;\nCyfirmaASCertificatesAlerts_CL\n| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())\n| extend\n Description=description,\n FirstSeen=first_seen,\n LastSeen=last_seen,\n ValidFrom=valid_from,\n ValidTo=valid_to,\n RiskScore=risk_score,\n Domain=sub_domain,\n TopDomain=top_domain,\n Protocols=protocols,\n SelfSigned=self_signed,\n AlertUID=alert_uid,\n UID=uid,\n CertificateData= cert_data,\n CertificateHash=cert_hash,\n IssuedBy=issued_by,\n IssuedTo=issued_to,\n ProviderName='CYFIRMA',\n ProductName='DeCYFIR/DeTCT'\n| project\n TimeGenerated,\n Description,\n Domain,\n TopDomain,\n RiskScore,\n FirstSeen,\n LastSeen,\n ValidFrom,\n ValidTo,\n Protocols,\n SelfSigned,\n CertificateData,\n CertificateHash,\n IssuedBy,\n IssuedTo,\n ProviderName,\n ProductName" }, { "name": "123fad02-6d9e-439e-8241-7a2fffa7e0a5 — CYFIRMA - High Severity Asset based Vulnerabilities Rule Alert", "description": "\"This rule detects high severity asset-based vulnerabilities from CYFIRMA's vulnerability intelligence data. It identifies vulnerabilities with a confidence score of 80 or higher, excluding those categorized as 'ATTACK_SURFACE_VULNERABILITY', and generates alerts for assets that may be at risk.\" (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)", "query": "// High severity - Asset based Vulnerabilities\nlet timeFrame = 5m;\nCyfirmaVulnerabilities_CL\n| extend parsed = parse_json(extensions)\n| extend extensionKeys = bag_keys(parsed)\n| mv-expand extensionKeys\n| extend extensionKeyStr = tostring(extensionKeys)\n| extend ext = parsed[extensionKeyStr]\n| extend props = ext.properties\n| extend \n attack_complexity = tostring(props.attack_complexity),\n cvss_score = toreal(props.cvss_score),\n integrity_impact = tostring(props.integrity_impact),\n impact_score = tostring(props.impact_score),\n attack_vector = tostring(props.attack_vector),\n privileges_required = tostring(props.privileges_required),\n cvss_version = tostring(props.cvss_version),\n user_interaction = tostring(props.user_interaction),\n cvss_vector = tostring(props.cvss_vector),\n scope = tostring(props.scope),\n confidentiality_impact = tostring(props.confidentiality_impact),\n exploitability_score = toreal(props.exploitability_score),\n products = tostring(props.products),\n technologies = tostring(props.technologies),\n vendors = tostring(props.vendors),\n confidence_score = toint(confidence),\n servers = tostring(props.servers),\n vulnerability_type = tostring(props.vulnerability_type),\n vulnerability_category = tostring(props.vulnerability_category),\n NetworkIPs = tostring(props.ips),\n ProviderName ='CYFIRMA',\n ProductName ='DeCYFIR/DeTCT'\n| summarize arg_max(\n integrity_impact,\n TimeGenerated, \n id,\n description,\n confidence_score,\n created,\n modified,\n attack_complexity,\n cvss_score,\n impact_score,\n attack_vector,\n privileges_required,\n cvss_version,\n user_interaction,\n cvss_vector,\n scope,\n confidentiality_impact,\n exploitability_score,\n products,\n technologies,\n vendors,\n ProviderName,\n ProductName,\n servers,\n NetworkIPs,\n vulnerability_type,\n vulnerability_category\n )\n by name\n| where confidence_score >= 80 and vulnerability_category != 'ATTACK_SURFACE_VULNERABILITY' and TimeGenerated between (ago(timeFrame) .. now())\n| project \n TimeGenerated,\n name,\n confidence_score,\n integrity_impact,\n attack_complexity,\n cvss_score,\n impact_score,\n attack_vector,\n UID = id,\n description,\n created,\n modified,\n privileges_required,\n cvss_version,\n user_interaction,\n cvss_vector,\n scope,\n confidentiality_impact,\n exploitability_score,\n products,\n technologies,\n vendors,\n ProviderName,\n ProductName,\n servers,\n NetworkIPs,\n vulnerability_type,\n vulnerability_category" }, { "name": "6cc62c46-dd44-46d7-8681-8422f780eabd — CYFIRMA - High Severity Attack Surface based Vulnerabilities Rule Alert", "description": "\"This rule detects high severity attack surface-based vulnerabilities from CYFIRMA's vulnerability intelligence data. It identifies vulnerabilities with a confidence score of 80 or higher, excluding those categorized as 'ASSET_VULNERABILITY', and generates alerts for assets that may be at risk.\" (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)", "query": "// High severity - Attack Surface based Vulnerabilities\nlet timeFrame= 5m;\nCyfirmaVulnerabilities_CL\n| extend parsed = parse_json(extensions)\n| extend extensionKeys = bag_keys(parsed)\n| mv-expand extensionKeys\n| extend extensionKeyStr = tostring(extensionKeys)\n| extend ext = parsed[extensionKeyStr]\n| extend props = ext.properties\n| extend \n attack_complexity = tostring(props.attack_complexity),\n cvss_score = toreal(props.cvss_score),\n integrity_impact = tostring(props.integrity_impact),\n impact_score = tostring(props.impact_score),\n attack_vector = tostring(props.attack_vector),\n privileges_required = tostring(props.privileges_required),\n cvss_version = tostring(props.cvss_version),\n user_interaction = tostring(props.user_interaction),\n cvss_vector = tostring(props.cvss_vector),\n scope = tostring(props.scope),\n confidentiality_impact = tostring(props.confidentiality_impact),\n exploitability_score = toreal(props.exploitability_score),\n products = tostring(props.products),\n technologies = tostring(props.technologies),\n vendors = tostring(props.vendors),\n confidence_score = toint(confidence),\n servers = tostring(props.servers),\n vulnerability_type = tostring(props.vulnerability_type),\n vulnerability_category = tostring(props.vulnerability_category),\n NetworkIPs = tostring(props.ips),\n ProviderName ='CYFIRMA',\n ProductName ='DeCYFIR/DeTCT'\n| summarize arg_max(\n integrity_impact,\n TimeGenerated, \n id,\n description,\n confidence_score,\n created,\n modified,\n attack_complexity,\n cvss_score,\n impact_score,\n attack_vector,\n privileges_required,\n cvss_version,\n user_interaction,\n cvss_vector,\n scope,\n confidentiality_impact,\n exploitability_score,\n products,\n technologies,\n vendors,\n ProviderName,\n ProductName,\n servers,\n NetworkIPs,\n vulnerability_type,\n vulnerability_category\n )\n by name\n| where confidence_score >= 80 and vulnerability_category == 'ATTACK_SURFACE_VULNERABILITY' and TimeGenerated between (ago(timeFrame) .. now())\n| project \n TimeGenerated,\n name,\n confidence_score,\n integrity_impact,\n attack_complexity,\n cvss_score,\n impact_score,\n attack_vector,\n UID = id,\n description,\n created,\n modified,\n privileges_required,\n cvss_version,\n user_interaction,\n cvss_vector,\n scope,\n confidentiality_impact,\n exploitability_score,\n products,\n technologies,\n vendors,\n ProviderName,\n ProductName,\n servers,\n NetworkIPs,\n vulnerability_type,\n vulnerability_category" } ], "spl": [], "esql": [ { "name": "6da6f80f-fe41-4814-8010-453e6164bd40 — Suspicious Curl from macOS Application", "description": "(EQL) Detects the use of curl by a macOS application binary to connect to a raw IP URI and download a second stage payload. Threat actors often utilize a benign looking or legitimate application as a first stage dropper. Curl is commonly used as it doesn't enforce Gatekeeper checks. (Source: Elastic's official detection-rules repository (Elastic License v2).)", "query": "process where host.os.type == \"macos\" and event.type == \"start\" and event.action == \"exec\" and \n process.name in (\"curl\", \"nscurl\") and \n process.args in (\"-o\", \"--output\", \"--download\", \"-dl\", \"-dir\", \"--directory\") and\n process.args regex~ \"\"\"http.*:\\/\\/[0-9]{2,3}.[0-9]{2,3}.[0-9]{2,3}.[0-9]{2,3}\\/.*\"\"\" and \n process.parent.name like~ (\"bash\", \"sh\", \"zsh\", \"osascript\", \"tclsh*\", \"python*\") and\n process.Ext.effective_parent.executable like \"/Applications/*\" and\n process.args_count <= 10 and \n not process.args like \"/Applications/*\" and\n not process.Ext.effective_parent.executable in (\"/Applications/iTerm.app/Contents/MacOS/iTerm2\",\n \"/Applications/Visual Studio Code.app/Contents/MacOS/Electron\", \n \"/Applications/Warp.app/Contents/MacOS/stable\")" }, { "name": "e7e0588b-2b55-4f88-afd1-cf98e95e0f58 — Suspicious Outbound Network Connection via Unsigned Binary", "description": "(EQL) Detects the execution of an unsigned or untrusted binary followed by an outbound network connection to a raw IP address on a non-standard port. Many malicious payloads will connect directly to C2 or a payload server using non-standard ports. (Source: Elastic's official detection-rules repository (Elastic License v2).)", "query": "sequence by process.entity_id with maxspan=1m\n [process where host.os.type == \"macos\" and event.type == \"start\" and event.action == \"exec\" and \n (process.code_signature.trusted == false or process.code_signature.exists == false) and\n process.args_count == 1 and\n not process.executable like \"/opt/homebrew/*\"]\n [network where host.os.type == \"macos\" and event.type == \"start\" and \n destination.domain == null and \n not destination.port in (443, 80, 53, 22, 25, 587, 993, 465, 8080, 8200, 9200) and \n destination.port < 49152 and\n not cidrmatch(destination.ip, \"0.0.0.0\", \"240.0.0.0/4\", \"233.252.0.0/24\", \"224.0.0.0/4\", \n \"198.19.0.0/16\", \"192.18.0.0/15\", \"192.0.0.0/24\", \"10.0.0.0/8\", \"127.0.0.0/8\", \n \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.2.0/24\", \"192.31.196.0/24\", \n \"192.52.193.0/24\", \"192.168.0.0/16\", \"192.88.99.0/24\", \"100.64.0.0/10\", \n \"192.175.48.0/24\", \"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\",\n \"::1\", \"FE80::/10\", \"FF00::/8\")]" } ] }, "automation": { "safe": [ "Add recommendation as Sentinel incident comment.", "Run enrichment queries.", "Create ServiceNow SecOps task." ], "approval_required": [ "Contain or disable the affected host/account.", "Any change to production configuration." ] }, "escalation_criteria": [ "Subvert Trust Controls activity observed on a privileged account or critical system.", "Activity follows or precedes other suspicious behaviour in the same investigation.", "Automated triage cannot confidently rule out malicious intent." ], "false_positive_considerations": [ "Legitimate administrative or maintenance activity matching this pattern.", "Approved security testing or red team exercise.", "Known benign software producing similar telemetry." ], "confluence": { "title": "T1553 - Subvert Trust Controls Response Guidance", "labels": [ "mitre", "attack", "d3fend", "secops", "basyrix" ], "sections": [ "summary", "d3fend_mappings", "investigation_steps", "response_actions", "queries", "automation", "escalation_criteria", "false_positive_considerations" ] } }