{'created': '2018-04-18T17:59:24.739Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'In user mode, Windows Authenticode (Citation: Microsoft '
                "Authenticode) digital signatures are used to verify a file's "
                'origin and integrity, variables that may be used to establish '
                'trust in signed code (ex: a driver with a valid Microsoft '
                'signature may be handled as safe). The signature validation '
                'process is handled via the WinVerifyTrust application '
                'programming interface (API) function,  (Citation: Microsoft '
                'WinVerifyTrust) which accepts an inquiry and coordinates with '
                'the appropriate trust provider, which is responsible for '
                'validating parameters of a signature. (Citation: SpectorOps '
                'Subverting Trust Sept 2017)\n'
                '\n'
                'Because of the varying executable file types and '
                'corresponding signature formats, Microsoft created software '
                'components called Subject Interface Packages (SIPs) '
                '(Citation: EduardosBlog SIPs July 2008) to provide a layer of '
                'abstraction between API functions and files. SIPs are '
                'responsible for enabling API functions to create, retrieve, '
                'calculate, and verify signatures. Unique SIPs exist for most '
                'file formats (Executable, PowerShell, Installer, etc., with '
                'catalog signing providing a catch-all  (Citation: Microsoft '
                'Catalog Files and Signatures April 2017)) and are identified '
                'by globally unique identifiers (GUIDs). (Citation: SpectorOps '
                'Subverting Trust Sept 2017)\n'
                '\n'
                'Similar to [Code '
                'Signing](https://attack.mitre.org/techniques/T1116), '
                'adversaries may abuse this architecture to subvert trust '
                'controls and bypass security policies that allow only '
                'legitimately signed code to execute on a system. Adversaries '
                'may hijack SIP and trust provider components to mislead '
                'operating system and whitelisting tools to classify malicious '
                '(or any) code as signed by: (Citation: SpectorOps Subverting '
                'Trust Sept 2017)\n'
                '\n'
                '* Modifying the <code>Dll</code> and <code>FuncName</code> '
                'Registry values in '
                '<code>HKLM\\SOFTWARE[\\WOW6432Node\\]Microsoft\\Cryptography\\OID\\EncodingType '
                '0\\CryptSIPDllGetSignedDataMsg\\{SIP_GUID}</code> that point '
                'to the dynamic link library (DLL) providing a SIP’s '
                'CryptSIPDllGetSignedDataMsg function, which retrieves an '
                'encoded digital certificate from a signed file. By pointing '
                'to a maliciously-crafted DLL with an exported function that '
                'always returns a known good signature value (ex: a Microsoft '
                'signature for Portable Executables) rather than the file’s '
                'real signature, an adversary can apply an acceptable '
                'signature value to all files using that SIP (Citation: GitHub '
                'SIP POC Sept 2017) (although a hash mismatch will likely '
                'occur, invalidating the signature, since the hash returned by '
                'the function will not match the value computed from the '
                'file).\n'
                '* Modifying the <code>Dll</code> and <code>FuncName</code> '
                'Registry values in '
                '<code>HKLM\\SOFTWARE\\[WOW6432Node\\]Microsoft\\Cryptography\\OID\\EncodingType '
                '0\\CryptSIPDllVerifyIndirectData\\{SIP_GUID}</code> that '
                'point to the DLL providing a SIP’s '
                'CryptSIPDllVerifyIndirectData function, which validates a '
                'file’s computed hash against the signed hash value. By '
                'pointing to a maliciously-crafted DLL with an exported '
                'function that always returns TRUE (indicating that the '
                'validation was successful), an adversary can successfully '
                'validate any file (with a legitimate signature) using that '
                'SIP (Citation: GitHub SIP POC Sept 2017) (with or without '
                'hijacking the previously mentioned '
                'CryptSIPDllGetSignedDataMsg function). This Registry value '
                'could also be redirected to a suitable exported function from '
                'an already present DLL, avoiding the requirement to drop and '
                'execute a new file on disk.\n'
                '* Modifying the <code>DLL</code> and <code>Function</code> '
                'Registry values in '
                '<code>HKLM\\SOFTWARE\\[WOW6432Node\\]Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{trust '
                'provider GUID}</code> that point to the DLL providing a trust '
                'provider’s FinalPolicy function, which is where the decoded '
                'and parsed signature is checked and the majority of trust '
                'decisions are made. Similar to hijacking SIP’s '
                'CryptSIPDllVerifyIndirectData function, this value can be '
                'redirected to a suitable exported function from an already '
                'present DLL or a maliciously-crafted DLL (though the '
                'implementation of a trust provider is complex).\n'
                '* **Note:** The above hijacks are also possible without '
                'modifying the Registry via [DLL Search Order '
                'Hijacking](https://attack.mitre.org/techniques/T1038).\n'
                '\n'
                'Hijacking SIP or trust provider components can also enable '
                'persistent code execution, since these malicious components '
                'may be invoked by any application that performs code signing '
                'or signature validation. (Citation: SpectorOps Subverting '
                'Trust Sept 2017)',
 'external_references': [{'external_id': 'T1198',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1198'},
                         {'description': 'Microsoft. (n.d.). Authenticode. '
                                         'Retrieved January 31, 2018.',
                          'source_name': 'Microsoft Authenticode',
                          'url': 'https://msdn.microsoft.com/library/ms537359.aspx'},
                         {'description': 'Microsoft. (n.d.). WinVerifyTrust '
                                         'function. Retrieved January 31, '
                                         '2018.',
                          'source_name': 'Microsoft WinVerifyTrust',
                          'url': 'https://msdn.microsoft.com/library/windows/desktop/aa388208.aspx'},
                         {'description': 'Graeber, M. (2017, September). '
                                         'Subverting Trust in Windows. '
                                         'Retrieved January 31, 2018.',
                          'source_name': 'SpectorOps Subverting Trust Sept '
                                         '2017',
                          'url': 'https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf'},
                         {'description': 'Navarro, E. (2008, July 11). SIP’s '
                                         '(Subject Interface Package) and '
                                         'Authenticode. Retrieved January 31, '
                                         '2018.',
                          'source_name': 'EduardosBlog SIPs July 2008',
                          'url': 'https://blogs.technet.microsoft.com/eduardonavarro/2008/07/11/sips-subject-interface-package-and-authenticode/'},
                         {'description': 'Hudek, T. (2017, April 20). Catalog '
                                         'Files and Digital Signatures. '
                                         'Retrieved January 31, 2018.',
                          'source_name': 'Microsoft Catalog Files and '
                                         'Signatures April 2017',
                          'url': 'https://docs.microsoft.com/windows-hardware/drivers/install/catalog-files'},
                         {'description': 'Graeber, M. (2017, September 14). '
                                         'PoCSubjectInterfacePackage. '
                                         'Retrieved January 31, 2018.',
                          'source_name': 'GitHub SIP POC Sept 2017',
                          'url': 'https://github.com/mattifestation/PoCSubjectInterfacePackage'},
                         {'description': 'Entrust Datacard. (2017, August 16). '
                                         'How do I enable CAPI 2.0 logging in '
                                         'Windows Vista, Windows 7 and Windows '
                                         '2008 Server?. Retrieved January 31, '
                                         '2018.',
                          'source_name': 'Entrust Enable CAPI2 Aug 2017',
                          'url': 'http://www.entrust.net/knowledge-base/technote.cfm?tn=8165'},
                         {'description': 'Microsoft. (2016, August 31). '
                                         'Registry (Global Object Access '
                                         'Auditing). Retrieved January 31, '
                                         '2018.',
                          'source_name': 'Microsoft Registry Auditing Aug 2016',
                          'url': 'https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn311461(v=ws.11)'},
                         {'description': 'Microsoft. (2012, July 2). Audit '
                                         'Registry. Retrieved January 31, '
                                         '2018.',
                          'source_name': 'Microsoft Audit Registry July 2012',
                          'url': 'https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd941614(v=ws.10)'}],
 'id': 'attack-pattern--72b5ef57-325c-411b-93ca-a3ca6fa17e31',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'defense-evasion'},
                       {'kill_chain_name': 'mitre-attack',
                        'phase_name': 'persistence'}],
 'modified': '2025-10-24T17:48:57.144Z',
 'name': 'SIP and Trust Provider Hijacking',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': True,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_contributors': ['Matt Graeber, @mattifestation, SpecterOps'],
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': False,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['Windows'],
 'x_mitre_version': '1.1'}