Techniques › T1553 › AN1247
AN1247 Analytic 1247
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection monitors extended attribute manipulation (xattr) to strip quarantine or trust metadata, anomalous installation of root certificates in /etc/ssl or /usr/local/share/ca-certificates, and unauthorized modification of system trust stores. Correlates with unexpected process execution involving package managers or custom certificate utilities.</p>
- Detects
- T1553 Subvert Trust Controls
- Part of
- DET0452 Detect Subversion of Trust Controls via Certificate, Registry, and Attribute Manipulation
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | chmod, chown, setxattr, or file writes to /etc/ssl/* or /usr/local/share/ca-certificates/* | DC0059 File Metadata |
| auditd:EXECVE | Process execution of update-ca-certificates or openssl with suspicious arguments | DC0064 Command Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
CertificatePathList | Paths to monitor for changes depending on distro-specific trust locations |
RegexPatterns | Regex patterns for suspicious use of xattr or openssl parameters |