DET0442 Detection Strategy for Subvert Trust Controls using SIP and Trust Provider Hijacking.

Technique Detected: T1553.003 (SIP and Trust Provider Hijacking)

Analytics

Windows

AN1222

Detection of anomalous registry modifications to Subject Interface Packages (SIPs) or trust provider DLL mappings, unexpected loading of non-Microsoft cryptographic modules, or attempts to redirect WinVerifyTrust validation logic. Defender view focuses on registry tampering, suspicious DLL loads into trusted processes, and abnormal trust validation failures correlated across event streams.

Log Sources

Mutable Elements