tfMITRE ATT&CK sub-technique

SIP and Trust Provider Hijacking T1553.003

sub-technique of T1553 Subvert Trust Controls

Tactic: Defense Impairment
Platform: Windows
Version: 2.0
Created: 05 February 2020
Last modified: 12 May 2026
Contributor: Matt Graeber, @mattifestation, SpecterOps

Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. In user mode, Windows Authenticode [1] digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function, [2] which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. [3]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules64th pct

Detection rules64th percentile · 64% of ATT&CK techniques have this many detection rules written or fewer.

Offense vs defense T1553.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 3

first rule: 2022 Q3

SIP and Trust Provider Hijacking detection strategy DET0442

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Subvert Trust Controls using SIP and Trust Provider Hijacking.

Enterprise

1 platform

AN1222 · Windows

Detection of anomalous registry modifications to Subject Interface Packages (SIPs) or trust provider DLL mappings, unexpected loading of non-Microsoft cryptographic modules, or attempts to redirect WinVerifyTrust validation logic. Defender view focuses on registry tampering, suspicious DLL loads into trusted processes, and abnormal trust validation failures correlated across event streams.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
File ModificationDC0061	WinEventLog:CodeIntegrity	EventCode=3033
Windows Registry Key ModificationDC0063	WinEventLog:Security	EventCode=4657

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
RegistryPathBaselines	Monitor for changes in Registry paths.
TimeWindow	Correlate between changes in Registry values, system files, and modules loaded.

Tests1Executorscmd 1Need elevation1 of 1Have prerequisites1Have cleanup1Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

SIP (Subject Interface Package) Hijacking via Custom DLL

windows

cmd

Required

Yes

Registers a DLL that logs signature checks, mimicking SIP hijacking. This test uses a DLL from https://github.com/gtworek/PSBits/tree/master/SIP and registers it using regsvr32, thereby causing the system to utilize it during signature checks, and logging said checks.

Input arguments

Name	Type	Default	Description
dll_payload	path	PathToAtomicsFolder\T1553.003\bin\GTSIPProvider.dll	Path to GTSIPProvider.dll

Attack command

regsvr32.exe #{dll_payload}

Cleanup command

regsvr32.exe /u #{dll_payload}

Prerequisite

GTSIPProvider.dll must exist on disk at specified location (#{dll_payload})

Check

if (Test-Path "#{dll_payload}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{dll_payload}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/gtworek/PSBits/raw/2aa885c7d09f7f100997bfa5ee0c404084177f24/SIP/GTSIPProvider.dll" -OutFile "#{dll_payload}"

GUID3d104af4-fb2c-43a3-a572-5a4ec6505526

Tests from Atomic Red Team (MIT licence) · technique definition

SIP and Trust Provider Hijacking detections T1553.003

5 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

64th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs