huntrule

Windows Registry: mpnotify SIP Provider Persistence via Winlogon

Detects registry writes to the Winlogon mpnotify location indicating potential SIP-provider persistence.

FreeUnreviewedSigmahighv1
title: "Windows Registry: mpnotify SIP Provider Persistence via Winlogon"
id: 92fedc10-546e-4492-b476-04cb0670d6a8
status: test
description: This rule flags registry creation or modification targeting the Winlogon mpnotify path used to register SIP providers, which can support persistence and defense evasion. Attackers may abuse this location to ensure their SIP-related components are loaded. The detection relies on registry set telemetry matching the targeted Winlogon mpnotify TargetObject substring.
references:
  - https://persistence-info.github.io/Data/mpnotify.html
  - https://www.youtube.com/watch?v=ggY3srD9dYs&ab_channel=GrzegorzTworek
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_mpnotify.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-21
modified: 2023-08-17
tags:
  - attack.persistence
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\mpnotify
  condition: selection
falsepositives:
  - Might trigger if a legitimate new SIP provider is registered. But this is not a common occurrence in an environment and should be investigated either way
level: high
license: DRL-1.1
related:
  - id: 92772523-d9c1-4c93-9547-b0ca500baba3
    type: derived

What it detects

This rule flags registry creation or modification targeting the Winlogon mpnotify path used to register SIP providers, which can support persistence and defense evasion. Attackers may abuse this location to ensure their SIP-related components are loaded. The detection relies on registry set telemetry matching the targeted Winlogon mpnotify TargetObject substring.

Known false positives

  • Might trigger if a legitimate new SIP provider is registered. But this is not a common occurrence in an environment and should be investigated either way

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.