Skip to content

codesigning.md

Latest commit

 

History

History
44 lines (29 loc) · 1.71 KB

codesigning.md

File metadata and controls

44 lines (29 loc) · 1.71 KB

Code Signing DLL

Location:

  • HKLM\SOFTWARE\Microsoft\Cryptography\Providers
  • HKLM\SOFTWARE\Microsoft\Cryptography\OID

Classification:

Criteria Value
Permissions Admin
Security context User
Persistence type Registry
Code type DLL
Launch type User initiated1
Impact Non-destructive
OS Version All OS versions
Dependencies OS only
Toolset Scriptable

Description:

Hijack attacks [...] permit persistent code execution in the context of any application that performs code signing or signature validation. By implementing a SIP or trust provider, code execution is possible.

References:

Credits:

Matt Graeber

See also:

Remarks:

Footnotes

  1. All cases of signature verification, including UAC prompts and displaying file properties. ↩