Windows Registry: mpnotify SIP Provider Persistence via Winlogon
Detects registry writes to the Winlogon mpnotify location indicating potential SIP-provider persistence.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-21
- Updated
- 2026-07-30
What it detects
This rule flags registry creation or modification targeting the Winlogon mpnotify path used to register SIP providers, which can support persistence and defense evasion. Attackers may abuse this location to ensure their SIP-related components are loaded. The detection relies on registry set telemetry matching the targeted Winlogon mpnotify TargetObject substring.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-mpnotify-sip-provider-persistence-via-winlogon-92772523
title: "Windows Registry: mpnotify SIP Provider Persistence via Winlogon"
id: 92fedc10-546e-4492-b476-04cb0670d6a8
status: test
description: This rule flags registry creation or modification targeting the Winlogon mpnotify path used to register SIP providers, which can support persistence and defense evasion. Attackers may abuse this location to ensure their SIP-related components are loaded. The detection relies on registry set telemetry matching the targeted Winlogon mpnotify TargetObject substring.
references:
- https://persistence-info.github.io/Data/mpnotify.html
- https://www.youtube.com/watch?v=ggY3srD9dYs&ab_channel=GrzegorzTworek
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_mpnotify.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-21
modified: 2023-08-17
tags:
- attack.persistence
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\mpnotify
condition: selection
falsepositives:
- Might trigger if a legitimate new SIP provider is registered. But this is not a common occurrence in an environment and should be investigated either way
level: high
license: DRL-1.1
related:
- id: 92772523-d9c1-4c93-9547-b0ca500baba3
type: derived