T1553.003Defense Impairment
SIP and Trust Provider Hijacking
Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. In user mode, Windows Authenticode digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
2 Sigma rules tagged T1553.003SIP and Trust Provider HijackingT1553.0032 general rules
- Kapeka Backdoor Configuration Persistencemediumtest
- Persistence Via New SIP Providermediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to SIP and Trust Provider Hijacking
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.