Windows SIP Provider Inventory

This analytic identifies all SIP (Subject Interface Package) providers on a Windows system by capturing DLL paths from relevant events. It is designed to detect potentially malicious SIP providers that could bypass trust controls and allow unauthorized code execution. The rule is intended for hunting and inventory purposes, prompting analysts to review for new and non-standard DLL paths to identify potential threats. If confirmed malicious, such activity could subvert system integrity, leading to unauthorized access or persistent threats.