Patchfirst
Patchfirst
T1553Defense Impairment

Subvert Trust Controls

Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate…

attack.mitre.org ↗
CVEs4
In 3
Reports1
Sub-techniques T1553.001Gatekeeper Bypass1T1553.002Code Signing5T1553.003SIP and Trust Provider HijackingT1553.004Install Root CertificateT1553.005Mark-of-the-Web Bypass11T1553.006Code Signing Policy Modification

Detections

4 Sigma rules tagged T1553
Subvert Trust ControlsT15534 general rules

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

CVEs linked to Subvert Trust Controls

4 CVEs, by priority. Each link shows its badge.
  1. CVE-2026-21510Microsoft Windows Shell Protection Mechanism Failure Vulnerability
    Microsoft · WindowsKEVPublic exploitHigh · 8.8T1211Exploitation for StealthT1553Subvert Trust Controls
    AI mapping from the description · primary impact
    61.2%Top 0.84%
    74.0priority
  2. CVE-2026-21513Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability
    Microsoft · WindowsKEVHigh · 8.8T1189Drive-by CompromiseT1553Subvert Trust Controls
    AI mapping from the description · primary impact
    15.9%Top 3.1%
    68.5priority
  3. CVE-2020-1464Microsoft Windows Spoofing Vulnerability
    Microsoft · WindowsKEVPublic exploitHigh · 7.8T1211Exploitation for StealthT1553Subvert Trust Controls
    AI mapping from the description · primary impact
    38.9%Top 1.4%
    68.2priority
  4. CVE-2019-3762Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2, and 19.1 contains an Improper Certificate Chain of Trust…
    Dell · Data Protection CentralHigh · 7.5T1588.004Digital CertificatesT1553Subvert Trust Controls
    MITRE CTID mapping of the CVE · primary impact
    0.6%Top 49%
    15.5priority

Linked through a sub-technique

17 more
  1. CVE-2024-21412Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability
    Microsoft · WindowsKEVRansomwarePublic exploitHigh · 8.1T1204.001Malicious LinkT1553.005Mark-of-the-Web Bypass1 report
    99.4%Top 0.06%
    82.5priority
  2. CVE-2013-3900Microsoft WinVerifyTrust function Remote Code Execution
    Microsoft · WinVerifyTrust functionKEVPublic exploitMedium · 5.5T1204.002Malicious FileT1553.002Code Signing1 report
    44.6%Top 1.2%
    80.5priority
  3. CVE-2020-0601Microsoft Windows CryptoAPI Spoofing Vulnerability
    Microsoft · WindowsKEVPublic exploitHigh · 8.1T1036MasqueradingT1553.002Code Signing
    89.1%Top 0.22%
    78.6priority
  4. CVE-2023-36884Microsoft Windows Search Remote Code Execution Vulnerability
    Microsoft · WindowsKEVRansomwarePublic exploitHigh · 7.5T1566PhishingT1204.002Malicious File+5 more
    99.4%Top 0.06%
    78.2priority
  5. CVE-2023-24880Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
    Microsoft · WindowsKEVRansomwareMedium · 4.4T1204.001Malicious LinkT1553.005Mark-of-the-Web Bypass
    78.0%Top 0.43%
    71.0priority
  6. CVE-2021-30657Apple macOS Unspecified Vulnerability
    Apple · macOSKEVPublic exploitMedium · 5.5T1204.002Malicious FileT1553.001Gatekeeper Bypass1 report
    68.5%Top 0.66%
    70.6priority
  7. CVE-2026-8398Daemon Tools Lite Embedded Malicious Code Vulnerability
    Daemon · Daemon Tools LiteKEVPublic exploitCritical · 9.8T1195.002Compromise Software Supply ChainT1553.002Code Signing
    1.5%Top 27%
    69.6priority
  8. CVE-2025-04117-Zip Mark of the Web Bypass Vulnerability
    7-Zip · 7-ZipKEVPublic exploitHigh · 7.0T1588.001MalwareT1566.001Spearphishing Attachment+1 more
    67.1%Top 0.7%
    67.8priority
  9. CVE-2022-41091Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability
    Microsoft · WindowsKEVRansomwareMedium · 5.4T1204.002Malicious FileT1553.005Mark-of-the-Web Bypass
    1.9%Top 20%
    67.7priority
  10. CVE-2023-41991Apple Multiple Products Improper Certificate Validation Vulnerability
    Apple · Multiple ProductsKEVPublic exploitMedium · 5.5T1204.002Malicious FileT1553.002Code Signing
    13.4%Top 3.6%
    66.1priority
  11. CVE-2024-38217Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability
    Microsoft · WindowsKEVPublic exploitMedium · 5.4T1553.005Mark-of-the-Web Bypass
    10.0%Top 4.4%
    65.9priority
  12. CVE-2012-0151Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability
    Microsoft · WindowsKEVHigh · 7.8T1204.002Malicious FileT1553.002Code Signing
    87.7%Top 0.24%
    63.4priority
  13. CVE-2024-21351Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
    Microsoft · WindowsKEVHigh · 7.6T1204.002Malicious FileT1553.005Mark-of-the-Web Bypass
    27.8%Top 1.9%
    62.9priority
  14. CVE-2023-32049Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability
    Microsoft · WindowsKEVHigh · 8.8T1204.002Malicious FileT1553.005Mark-of-the-Web Bypass
    4.2%Top 9.1%
    62.3priority
  15. CVE-2024-38213Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
    Microsoft · WindowsKEVMedium · 6.5T1553.005Mark-of-the-Web Bypass
    13.6%Top 3.5%
    61.8priority
  16. CVE-2023-36584Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability
    Microsoft · WindowsKEVMedium · 5.4T1204.001Malicious LinkT1553.005Mark-of-the-Web Bypass
    3.3%Top 12%
    59.4priority
  17. CVE-2022-41049Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability
    Microsoft · WindowsKEVMedium · 5.4T1204.001Malicious LinkT1553.005Mark-of-the-Web Bypass
    2.6%Top 14%
    58.9priority

Passages that support these links

↑ ↓ chooseEnter openEsc close