Persistence Via New SIP Provider Registration
This rule detects attempts to establish persistence and evade defenses by registering a new Subject Interface Package (SIP) provider. Attackers can modify specific registry keys related to cryptographic providers to redirect signature validation functions to malicious DLLs. This allows them to bypass application control mechanisms by making the system trust unsigned or malicious code as legitimately signed. The rule specifically looks for modifications to registry paths associated with Microsoft Cryptography Providers and OID EncodingType, where the 'Dll' or '$DLL' values are being set, while filtering out known legitimate SIP registrations by the OS or specific software like WINTRUST.DLL and mso.dll. It also filters out specific legitimate activity related to poqexec.exe and PsfSip.dll.
Sigma
