T1553.003sub-technique of T1553 Subvert Trust Controls
SIP and Trust Provider Hijacking
Windowsnothing on this site yetT1553.003 on attack.mitre.org
Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. In user mode, Windows Authenticode digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe).
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Ransomware, suspected or confirmed
Files renamed or unreadable, a ransom note, or backup deletion commands seen.
how MITRE says to see it
Detection Strategy for Subvert Trust Controls using SIP and Trust Provider Hijacking.
- Detection of anomalous registry modifications to Subject Interface Packages (SIPs) or trust provider DLL mappings, unexpected loading of non-Microsoft cryptographic modules, or attempts to redirect WinVerifyTrust validation logic.
what reduces it
- M1038 Execution Prevention. Enable application control solutions such as AppLocker and/or Device Guard to block the loading of malicious SIP DLLs.
- M1022 Restrict File and Directory Permissions. Restrict storage and execution of SIP DLLs to protected directories, such as C:\\Windows, rather than user directories.
- M1024 Restrict Registry Permissions. Ensure proper permissions are set for Registry hives to prevent users from modifying keys related to SIP and trust provider components. Components may still be able to be hijacked to suitable functions already present on disk if malicious modifications to Registry keys are not prevented.