T1553.003 — SIP and Trust Provider Hijacking

Tactic: Defense Impairment · Platforms: Windows

Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. In user mode, Windows Authenticode digital signatures are used to verify a file's origin and integrity, variables that may be…

Sub-technique of Subvert Trust Controls (T1553).

Sigma detection rules (1)

T1553.003 Subvert Trust Controls: SIP and Trust Provider Hijacking

title: "T1553.003 Subvert Trust Controls: SIP and Trust Provider Hijacking"
id: d55b38cc-0900-423e-ace6-ad506b8c86a0
description: 'Detection Strategy for SIP and Trust Provider Hijacking, retargeted to registry value modifications under HKLM\SOFTWARE\Microsoft\Cryptography (CryptSIPDll*/FinalPolicy). (Data Component: Windows Registry Key Modification; baseline tier: windows-eventid.) Tune using: RegistryPathBaselines, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1553/003
author: Shahrukh Khan
date: 2026-04-11
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1553.003

logsource:
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '13'
    TargetObject|contains:
      - '\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\'
      - '\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\'
      - '\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\'
      - '\Cryptography\Providers\Trust\FinalPolicy\'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - Legitimate third-party signing/verification software registering its own SIP provider.

level: medium

Related sub-techniques

Explore