Detectionmediumtest

Persistence Via New SIP Provider

Detects when an attacker register a new SIP provider for persistence and defense evasion

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems)Created Thu Jul 21Updated Thu Aug 175a2b21ee-6aaa-4234-ac9d-59a59edf90a1windows

Log Source

WindowsRegistry Set

ProductWindows← raw: windows

CategoryRegistry Set← raw: registry_set

Detection Logic

detection:
    selection_root:
        TargetObject|contains:
            - '\SOFTWARE\Microsoft\Cryptography\Providers\'
            - '\SOFTWARE\Microsoft\Cryptography\OID\EncodingType'
            - '\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\'
            - '\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType'
    selection_dll:
        TargetObject|contains:
            - '\Dll'
            - '\$DLL'
    filter:
        Details:
            # Add more legitimate SIP providers according to your env
            - WINTRUST.DLL
            - mso.dll
    filter_poqexec:
        Image: 'C:\Windows\System32\poqexec.exe'
        TargetObject|contains: '\CryptSIPDll'
        Details: 'C:\Windows\System32\PsfSip.dll'
    condition: all of selection_* and not 1 of filter*