Suspicious SIP or trust provider registration

title: Suspicious SIP or trust provider registration
description: Detects scenarios where an attacker attempts to register a SIP or trust provider in order to mislead signature validation checks.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1553-%20Subvert%20Trust%20Controls
- https://github.com/mattifestation/PoCSubjectInterfacePackage
- https://github.com/gtworek/PSBits/tree/master/SIP
- https://posts.specterops.io/code-sgning-certificate-cloning-attacks-and-defenses-6f98657fc6ec
- https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf
- https://www.ired.team/offensive-security/persistence/t1198-trust-provider-hijacking
- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/defense-evasion/t1553-subvert-trust-controls/sip-and-trust-provider-hijacking
tags:
- attack.defense_evasion
- attack.t1553.003 # Subvert Trust Controls: SIP and Trust Provider Hijacking 
author: mdecrevoisier (adapted from Nasreddine Bencherchali)
status: experimental
logsource:
  product: windows
  category: registry_set
detection: # path sample: "HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{xxxx-xxxx-xxxx-xxxxx}"
  selection:
    TargetObject|contains:
      - '\SOFTWARE\Microsoft\Cryptography\Providers\'
      - '\SOFTWARE\Microsoft\Cryptography\OID\EncodingType'
      - '\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\'
      - '\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType'
    Details|contains:
      - '.dll' 
      - '\dll'
      - '\$dll'
  condition: selection
falsepositives:
- None 
level: high