OPSEC Notes

OPSEC Notes

Artifacts left by each TrustMeBro technique, where they appear, and how to clean them.

SIP Hijack

Artifact	Location	Survives Reboot	Cleaned By
Registry: Dll = ntdll.dll	HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{GUID}	Yes	TrustMeBro.exe hijack --clean or clean --sip
Registry: FuncName = DbgUiContinue	Same key as above	Yes	Same
WOW6432Node mirror	HKLM\SOFTWARE\WOW6432Node\... (same path)	Yes	Same
Sysmon Event ID 13	Registry value set event (if Sysmon installed)	Log entry persists	Not cleanable. Detectable.

Note: No files written to disk. No services created. No scheduled tasks.

FinalPolicy Hijack

Artifact	Location	Survives Reboot	Cleaned By
Registry: $Function = SoftpubCleanup	HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11d0-8CC2-00C04FC295EE}	Yes	TrustMeBro.exe hijack --finalpolicy --clean or clean --finalpolicy
Registry: $DLL = WINTRUST.DLL	Same key	Yes (value already exists, only $Function changes)	Same
Sysmon Event ID 13	Registry value set event	Log entry persists	Not cleanable

Note: The $DLL value stays as WINTRUST.DLL (unchanged). Only $Function changes. This makes the modification harder to detect by value scanning since the DLL path looks legitimate.

Custom Trust Provider

Artifact	Location	Survives Reboot	Cleaned By
New registry key	HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{CUSTOM-GUID}	Yes	TrustMeBro.exe hijack --custom-provider {GUID} --clean
Sysmon Event ID 12/13	Key create + value set	Log entry persists	Not cleanable

SIP Execution Surface (sip-exec)

Artifact	Location	Survives Reboot	Cleaned By
Registry key + Dll/FuncName values	HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{GUID}	Yes	TrustMeBro.exe sip-exec remove --guid <alias>
DLL file on disk	Wherever the operator placed it	Yes	Manual deletion
DLL loaded in processes	Any process calling WinVerifyTrust after registration	Until process exits	Kill process or reboot

SigStash (Payload Embedding)

Artifact	Location	Survives Reboot	Cleaned By
Modified WIN_CERTIFICATE in PE	Inside the output file's signature region	N/A (file artifact)	Delete the file
No registry changes	N/A	N/A	N/A

Note: The carrier file passes all signature verification checks. The payload is inside the PKCS#7 DER structure. No tool flags the embedded data by default.

FormatGhost

Artifact	Location	Survives Reboot	Cleaned By
Registry: Dll + FuncName	HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFormatObject\{OID}	Yes	reg delete the key or register.py --clean
DLL file on disk	Wherever the operator placed it	Yes	Manual deletion
Sysmon Event ID 12/13	Key create + value set	Log entry persists	Not cleanable

General OPSEC Guidance

• Every registry write generates a Sysmon Event ID 12 (key create) or 13 (value set) if Sysmon is running. No way around this without disabling Sysmon first.
• SIP and Trust Provider values are cached per-process. After any registry change, the effect appears only in new processes. Existing processes retain the old values.
• Log out and log back in to ensure all shell processes pick up the new values. Opening a new cmd.exe or PowerShell window is sufficient for testing.
• The probe command reads CI flags without writing anything. Safe to run at any time.
• steal and embed/extract are file operations. No registry, no event log, no network.