{"id":"T1553.003","name":"SIP and Trust Provider Hijacking","url":"https://attack.mitre.org/techniques/T1553/003","tactics":["defense-impairment"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0442","stix_id":"x-mitre-detection-strategy--541f2335-1046-4621-9829-1a4a305069c5","name":"Detection Strategy for Subvert Trust Controls using SIP and Trust Provider Hijacking.","url":"https://attack.mitre.org/detectionstrategies/DET0442","analytics":[{"id":"AN1222","stix_id":"x-mitre-analytic--5b6f6588-3434-4199-b16f-af44ae546c3d","name":"Analytic 1222","description":"Detection of anomalous registry modifications to Subject Interface Packages (SIPs) or trust provider DLL mappings, unexpected loading of non-Microsoft cryptographic modules, or attempts to redirect WinVerifyTrust validation logic. Defender view focuses on registry tampering, suspicious DLL loads into trusted processes, and abnormal trust validation failures correlated across event streams.","url":"https://attack.mitre.org/detectionstrategies/DET0442#AN1222","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4657","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:CodeIntegrity","channel":"EventCode=3033","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"wineventlog-codeintegrity"}],"mutable_elements":[{"field":"RegistryPathBaselines","description":"Monitor for changes in Registry paths."},{"field":"TimeWindow","description":"Correlate between changes in Registry values, system files, and modules loaded."}],"live":true,"detection_strategies":["DET0442"],"techniques":["T1553.003"]}],"live":true,"version":"1.0","techniques":["T1553.003"]}],"sigma_rules":[{"id":"5a2b21ee-6aaa-4234-ac9d-59a59edf90a1","title":"Persistence Via New SIP Provider","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-07-21","modified":"2023-08-17","description":"Detects when an attacker register a new SIP provider for persistence and defense evasion","references":["https://persistence-info.github.io/Data/codesigning.html","https://github.com/gtworek/PSBits/tree/master/SIP","https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1553.003"],"path":"rules/windows/registry/registry_set/registry_set_sip_persistence.yml","techniques":["T1553.003"],"cves":[]},{"id":"cbaa3ef3-07a9-4c8e-82d1-9e40578da7fd","title":"Kapeka Backdoor Configuration Persistence","author":"Swachchhanda Shrawan Poudel","status":"test","level":"medium","date":"2024-07-03","modified":null,"description":"Detects registry set activity of a value called \"Seed\" stored in the \"\\Cryptography\\Providers\\\" registry key.\nThe Kapeka backdoor leverages this location to register a new SIP provider for backdoor configuration persistence.\n","references":["https://labs.withsecure.com/publications/kapeka","https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.defense-impairment","attack.t1553.003","detection.emerging-threats"],"path":"rules-emerging-threats/2024/Malware/kapeka/registry_set_malware_kapeka_backdoor_configuration.yml","techniques":["T1553.003"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}