Subvert Trust Controls
Technique · ATTACK:enterprise:T1553
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1553",
"title": "Subvert Trust Controls",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1553",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--b83e166d-13d7-4b52-8677-dff90c548fd7",
"external_id": "T1553",
"domain": "enterprise",
"created": "2020-02-05T14:54:07.588Z",
"modified": "2026-05-12T15:12:00.709Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"defense-impairment"
],
"source_references": [
{
"source_name": "SpectorOps Subverting Trust Sept 2017",
"url": "https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf"
},
{
"source_name": "Securelist Digital Certificates",
"url": "https://securelist.com/why-you-shouldnt-completely-trust-files-signed-with-digital-certificates/68593/"
},
{
"source_name": "Symantec Digital Certificates",
"url": "http://www.symantec.com/connect/blogs/how-attackers-steal-private-keys-digital-certificates"
}
]
}Explicit source assertions (13)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1553
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--15b9b22e-7896-4219-8ec9-59b099644a6f
ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1553
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c0ec3cf-8942-4d47-b1ac-dfdaca31bac0
SpectorOps Code Signing Dec 2017ATTACK:enterprise:T1553.005 → subtechnique-of → ATTACK:enterprise:T1553
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2fb18a45-8ba0-401d-9ee6-18099b4c2c39
ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1553
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64aa92d9-abdb-494c-8646-8548aa7c25a5
Novetta-AxiomATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1553
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--764f3883-da8b-421d-96ed-e14878bcc72e
ATTACK:enterprise:S9008 → uses → ATTACK:enterprise:T1553
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--99bed0a8-e2af-40ef-bcf4-45792749f15f
Socket Shai-Hulud November 2025ATTACK:enterprise:T1553.002 → subtechnique-of → ATTACK:enterprise:T1553
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a10133d4-069f-4678-bcfb-72aeaa575296
ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1553
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a152969e-2530-4cb7-acdf-f93b138116d0
ATTACK:enterprise:T1553.004 → subtechnique-of → ATTACK:enterprise:T1553
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a33048dc-d843-497c-b8e0-048cc3a08ac7
ATTACK:enterprise:T1553.003 → subtechnique-of → ATTACK:enterprise:T1553
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6a3348c-99db-49d0-b98e-9bc80b4cef06
ATTACK:enterprise:T1553.006 → subtechnique-of → ATTACK:enterprise:T1553
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bb6f2e41-2f67-49e7-ade1-490abeb9274a
ATTACK:enterprise:T1553.001 → subtechnique-of → ATTACK:enterprise:T1553
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c2e18006-9caf-494c-9d41-4a4ef5b3bf78
ATTACK:enterprise:M1054 → mitigates → ATTACK:enterprise:T1553
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9c08e10-909d-46d0-aa15-b99d1487be62
Wikipedia HPKP