ID | Technique | Tactic |
---|---|---|
T1553.003 | SIP and Trust Provider Hijacking | Defense Evasion |
Detection: Windows SIP Provider Inventory
Description
The following analytic identifies all SIP (Subject Interface Package) providers on a Windows system using PowerShell scripted inputs. It detects SIP providers by capturing DLL paths from relevant events. This activity is significant because malicious SIP providers can be used to bypass trust controls, potentially allowing unauthorized code execution. If confirmed malicious, this activity could enable attackers to subvert system integrity, leading to unauthorized access or persistent threats within the environment. Analysts should review for new and non-standard paths to identify potential threats.
Search
1`subjectinterfacepackage` Dll=*\\*.dll
2| stats count min(_time) as firstTime max(_time) as lastTime values(Dll) by Path host
3| `security_content_ctime(firstTime)`
4| `security_content_ctime(lastTime)`
5| `windows_sip_provider_inventory_filter`
Data Source
Name | Platform | Sourcetype | Source | Supported App |
---|---|---|---|---|
N/A | N/A | N/A | N/A | N/A |
Macros Used
Name | Value |
---|---|
security_content_ctime | convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$) |
windows_sip_provider_inventory_filter | search * |
windows_sip_provider_inventory_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Risk Event | False |
Implementation
To implement this analytic, one must first perform inventory using a scripted inputs. Review the following Gist - https://gist.github.com/MHaggis/75dd5db546c143ea67703d0e86cdbbd1
Known False Positives
False positives are limited as this is a hunting query for inventory.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
A list of SIP providers on the system is available. Review for new and non-standard paths for SIP providers on $host$. | 25 | 50 | 50 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | powershell://SubjectInterfacePackage |
PwSh:SubjectInterfacePackage |
Integration | ✅ Passing | Dataset | powershell://SubjectInterfacePackage |
PwSh:SubjectInterfacePackage |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 2