detection.wiki

Detection rules › Sigma

Suspicious SIP or trust provider registration

Status
experimental
Severity
high
Log source
product windows, category registry_set
Author
mdecrevoisier (adapted from Nasreddine Bencherchali)
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to register a SIP or trust provider in order to mislead signature validation checks.

MITRE ATT&CK coverage

TacticTechniques
Defense ImpairmentT1553.003 Subvert Trust Controls: SIP and Trust Provider Hijacking

Event coverage

ProviderEventTitle
SysmonEvent ID 13RegistryEvent (Value Set)

Rule body yaml

title: Suspicious SIP or trust provider registration
description: Detects scenarios where an attacker attempts to register a SIP or trust provider in order to mislead signature validation checks.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1553-%20Subvert%20Trust%20Controls
- https://github.com/mattifestation/PoCSubjectInterfacePackage
- https://github.com/gtworek/PSBits/tree/master/SIP
- https://posts.specterops.io/code-sgning-certificate-cloning-attacks-and-defenses-6f98657fc6ec
- https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf
- https://www.ired.team/offensive-security/persistence/t1198-trust-provider-hijacking
- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/defense-evasion/t1553-subvert-trust-controls/sip-and-trust-provider-hijacking
tags:
- attack.defense_evasion
- attack.t1553.003 # Subvert Trust Controls: SIP and Trust Provider Hijacking 
author: mdecrevoisier (adapted from Nasreddine Bencherchali)
status: experimental
logsource:
  product: windows
  category: registry_set
detection: # path sample: "HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{xxxx-xxxx-xxxx-xxxxx}"
  selection:
    TargetObject|contains:
      - '\SOFTWARE\Microsoft\Cryptography\Providers\'
      - '\SOFTWARE\Microsoft\Cryptography\OID\EncodingType'
      - '\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\'
      - '\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType'
    Details|contains:
      - '.dll' 
      - '\dll'
      - '\$dll'
  condition: selection
falsepositives:
- None 
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  TargetObject|contains:
    - '\SOFTWARE\Microsoft\Cryptography\Providers\'
    - '\SOFTWARE\Microsoft\Cryptography\OID\EncodingType'
    - '\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\'
    - '\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType'
  Details|contains:
    - '.dll'
    - '\dll'
    - '\$dll'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Detailsmatch
  • .dll corpus 5 (sigma 5)
  • \$dll
  • \dll
TargetObjectmatch
  • \SOFTWARE\Microsoft\Cryptography\OID\EncodingType corpus 2 (sigma 2)
  • \SOFTWARE\Microsoft\Cryptography\Providers\ corpus 2 (sigma 2)
  • \SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType corpus 2 (sigma 2)
  • \SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\ corpus 2 (sigma 2)