Detect SIP and Trust Provider Hijacking in Splunk
Adversaries may tamper with Subject Interface Package (SIP) and trust provider components to mislead the operating system and application control tools during Authenticode signature validation. SIPs provide an abstraction layer between the WinVerifyTrust API and specific file formats, identified by GUIDs in the registry. Adversaries hijack these components by modifying Dll and FuncName registry values under HKLM\SOFTWARE[\WOW6432Node]\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{GUID} (to return a forged known-good certificate) or CryptSIPDllVerifyIndirectData\{GUID} (to always return TRUE for hash validation). Trust providers may be hijacked by modifying $DLL and $Function values under HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{GUID}. This allows malicious or unsigned code to appear validly signed to application whitelisting tools, AppLocker, WDAC, and SmartScreen. Because SIP components are invoked by any process performing signature validation, hijacking them also provides persistent code execution opportunities.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1553 Subvert Trust Controls
- Sub-technique
- T1553.003 SIP and Trust Provider Hijacking
- Canonical reference
- https://attack.mitre.org/techniques/T1553/003/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
(TargetObject="*\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllGetSignedDataMsg\\*"
OR TargetObject="*\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllVerifyIndirectData\\*"
OR TargetObject="*\\Cryptography\\Providers\\Trust\\FinalPolicy\\*")
(TargetObject="*\\Dll" OR TargetObject="*\\FuncName"
OR TargetObject="*\\$DLL" OR TargetObject="*\\$Function")
| eval SIPType=case(
match(TargetObject, "CryptSIPDllGetSignedDataMsg"), "SIP-GetSignedDataMsg",
match(TargetObject, "CryptSIPDllVerifyIndirectData"), "SIP-VerifyIndirectData",
match(TargetObject, "Trust\\\\FinalPolicy"), "TrustProvider-FinalPolicy",
true(), "Unknown")
| eval IsWow64=if(match(TargetObject, "WOW6432Node"), 1, 0)
| eval NewDllPath=Details
| eval IsNonSystemDll=if(
match(lower(Details), "(windows\\\\system32|windows\\\\syswow64|wintrust\.dll|mssip32\.dll)"),
0, 1)
| table _time, host, User, Image, CommandLine, TargetObject, NewDllPath, SIPType, IsWow64, IsNonSystemDll
| sort - _timeDetects SIP and trust provider registry hijacking using Sysmon Event ID 13 (Registry Value Set). Monitors writes to the Dll, FuncName, $DLL, and $Function registry values under Windows Cryptography OID and Trust provider keys. The IsNonSystemDll flag (1 = suspicious) identifies cases where the new DLL path points outside System32 or SysWOW64, which is the primary indicator of malicious DLL substitution. Covers both 64-bit and WOW6432Node 32-bit registry paths.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate installation of cryptographic middleware or HSM drivers (SafeNet, Thales, Gemalto) that register custom SIPs for hardware token certificate formats
- Enterprise PKI infrastructure tools (DigiCert, Entrust enrollment agents) that register custom SIP providers as part of installation
- Security software updates that modify trust provider DLL references during installation or major version upgrades
- Development tools or code-signing utilities that register custom SIPs for proprietary binary formats during installation
Other platforms for T1553.003
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1SIP CryptSIPDllVerifyIndirectData Hijack — PE SIP Verify Function Override
Expected signal: Sysmon Event ID 13 (Registry Value Set): Two sequential events with TargetObject = HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\Dll and ...\FuncName. Details field shows C:\Windows\System32\ntdll.dll and DbgUiContinue respectively. Image=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe. DeviceRegistryEvents in MDE: ActionType=RegistryValueSet, InitiatingProcessFileName=powershell.exe.
- Test 2SIP CryptSIPDllGetSignedDataMsg Hijack via reg.exe — PE SIP Certificate Retrieval Override
Expected signal: Sysmon Event ID 1 (Process Create): reg.exe with CommandLine containing 'CryptSIPDllGetSignedDataMsg' and '/v Dll'. Sysmon Event ID 13 (Registry Value Set): Two events for the Dll and FuncName values under CryptSIPDllGetSignedDataMsg\{C689AAB8...}, Details shows ntdll.dll and DbgPrintEx. Security Event ID 4688 (if command line auditing enabled): reg.exe process creation with command line. DeviceProcessEvents in MDE: FileName=reg.exe with full command line.
- Test 3Trust Provider FinalPolicy Registry Hijack — Software Publishing Trust Provider
Expected signal: Sysmon Event ID 13 (Registry Value Set): Two sequential events with TargetObject = HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL and ...\$Function. Details field shows C:\Windows\System32\ntdll.dll and DbgUiContinue. Image=powershell.exe. DeviceRegistryEvents in MDE: RegistryKey contains Trust\FinalPolicy, RegistryValueName=$DLL and $Function, ActionType=RegistryValueSet.
References (10)
- https://attack.mitre.org/techniques/T1553/003/
- https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf
- https://github.com/mattifestation/PoCSubjectInterfacePackage
- https://msdn.microsoft.com/library/windows/desktop/aa388208.aspx
- https://msdn.microsoft.com/library/ms537359.aspx
- https://blogs.technet.microsoft.com/eduardonavarro/2008/07/11/sips-subject-interface-package-and-authenticode/
- https://docs.microsoft.com/windows-hardware/drivers/install/catalog-files
- https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd941614(v=ws.10)
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.003/T1553.003.md
- https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck
Unlock Pro Content
Get the full detection package for T1553.003 including response playbook, investigation guide, and atomic red team tests.