1200KM / detection
T1553.003 SIP and Trust Provider Hijacking — Detection Rules
Detection workspace for T1553.003 SIP and Trust Provider Hijacking: 1 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Persistence Via New SIP Provider · test · medium · {"category":"registry_set","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0442 Detection Strategy for Subvert Trust Controls using SIP and Trust Provider Hijacking.
AN1222 Analytic 1222
Detection of anomalous registry modifications to Subject Interface Packages (SIPs) or trust provider DLL mappings, unexpected loading of non-Microsoft cryptographic modules, or attempts to redirect WinVerifyTrust validation logic. Defender view focuses on registry tampering, suspicious DLL loads into trusted processes, and abnormal trust validation failures correlated across event streams.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1553.003 simulation workspace
No reviewed association in this snapshot.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.