Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. In user mode, Windows Authenticode (Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function, (Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. (Citation: SpectorOps Subverting Trust Sept 2017)
Because of the varying executable file types and corresponding signature formats, Microsoft created software components called Subject Interface Packages (SIPs) (Citation: EduardosBlog SIPs July 2008) to provide a layer of abstraction between API functions and files. SIPs are responsible for enabling API functions to create, retrieve, calculate, and verify signatures. Unique SIPs exist for most file formats (Executable, PowerShell, Installer, etc., with catalog signing providing a catch-all (Citation: Microsoft Catalog Files and Signatures April 2017)) and are identified by globally unique identifiers (GUIDs). (Citation: SpectorOps Subverting Trust Sept 2017)
Similar to Code Signing, adversaries may abuse this architecture to subvert trust controls and bypass security policies that allow only legitimately signed code to execute on a system. Adversaries may hijack SIP and trust provider components to mislead operating system and application control tools to classify malicious (or any) code as signed by: (Citation: SpectorOps Subverting Trust Sept 2017)
Hijacking SIP or trust provider components can also enable persistent code execution, since these malicious components may be invoked by any application that performs code signing or signature validation. (Citation: SpectorOps Subverting Trust Sept 2017)
View in MITRE ATT&CK®Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name |
---|---|---|---|---|
AC-3 | Access Enforcement | Protects | T1553.003 | SIP and Trust Provider Hijacking |
AC-6 | Least Privilege | Protects | T1553.003 | SIP and Trust Provider Hijacking |
CA-7 | Continuous Monitoring | Protects | T1553.003 | SIP and Trust Provider Hijacking |
CM-2 | Baseline Configuration | Protects | T1553.003 | SIP and Trust Provider Hijacking |
CM-6 | Configuration Settings | Protects | T1553.003 | SIP and Trust Provider Hijacking |
CM-7 | Least Functionality | Protects | T1553.003 | SIP and Trust Provider Hijacking |
SI-10 | Information Input Validation | Protects | T1553.003 | SIP and Trust Provider Hijacking |
SI-3 | Malicious Code Protection | Protects | T1553.003 | SIP and Trust Provider Hijacking |
SI-4 | System Monitoring | Protects | T1553.003 | SIP and Trust Provider Hijacking |
SI-7 | Software, Firmware, and Information Integrity | Protects | T1553.003 | SIP and Trust Provider Hijacking |