Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site.

Adversaries may attempt to subvert these trust mechanisms. The method adversaries use will depend on the specific mechanism they seek to subvert. Adversaries may conduct [File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222) or [Modify Registry](https://attack.mitre.org/techniques/T1112) in support of subverting these controls.(Citation: SpectorOps Subverting Trust Sept 2017) Adversaries may also create or steal code signing certificates to acquire trust on target systems.(Citation: Securelist Digital Certificates)(Citation: Symantec Digital Certificates) 
Subvert Trust Controls
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1553  external_id: T1553     source_name: SpectorOps Code Signing Dec 2017  description: Graeber, M. (2017, December 22). Code Signing Certificate Cloning Attacks and Defenses. Retrieved April 3, 2018.  url: https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec     source_name: SpectorOps Subverting Trust Sept 2017  description: Graeber, M. (2017, September). Subverting Trust in Windows. Retrieved January 31, 2018.  url: https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf     source_name: Securelist Digital Certificates  description: Ladikov, A. (2015, January 29). Why You Shouldn’t Completely Trust Files Signed with Digital Certificates. Retrieved March 31, 2016.  url: https://securelist.com/why-you-shouldnt-completely-trust-files-signed-with-digital-certificates/68593/     source_name: Symantec Digital Certificates  description: Shinotsuka, H. (2013, February 22). How Attackers Steal Private Keys from Digital Certificates. Retrieved March 31, 2016.  url: http://www.symantec.com/connect/blogs/how-attackers-steal-private-keys-digital-certificates     