Technique T1553

Subvert Trust Controls

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE

Subvert Trust Controls (T1553) — a Defense Evasion technique, observed in public incident reporting.

MITRE ATT&CKT1553

TacticDefense Evasion

Incidents on file10

Detection & mitigation

Monitor for PE files with appended data after the signature block using tools like sigcheck with -a flag or YARA rules that detect anomalous certificate table sizes. Enforce strict validation policies that reject files with malformed or non-standard certificate structures, and consider using multiple integrity checks beyond Authenticode alone.

Observed in the wild

2026-05-23

code signing abuse
CVE-2013-3900: WinVerifyTrust Signature Validation Weakness

2026-05-20

code signing abuse
TamperedChef Malware Campaign Uses Signed Trojanized Apps to Deliver Stealers and RATs

2026-05-20

code signing abuse
Fox Tempest Malware-Signing Service Abused Microsoft Artifact Signing to Certify Malware

2026-05-14

code signing abuse
OpenAI employee devices breached via TanStack supply chain attack

2026-05-04

code signing abuse
DigiCert Support Systems Breached, EV Code-Signing Certificates Fraudulently Issued and Used to Sign Malware

2025-06-19

code signing abuse
Signature Kid Tool Demonstrates Digital Signature Spoofing to Bypass Kernel-Mode Protections

2024-08-06

code signing abuse
Elastic Security Labs Details Bypass Techniques for Windows Smart App Control and SmartScreen

2024-05-10

code signing abuse
REvil Ransomware Gang Exploits Kaseya VSA Zero-Days in Supply-Chain Attack

2024-04-26

code signing abuse
Windows SmartScreen Security Feature Bypass Vulnerability (CVE-2023-24880)

2023-10-25

code signing abuse
Proof-of-Concept Exploit for CVE-2023-41991 CoreTrust Bypass Published

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →