Persistence Via New SIP Provider

Action1: actionname = "Registry value modified" AND ((OBJECTNAME contains "\SOFTWARE\Microsoft\Cryptography\Providers\,\SOFTWARE\Microsoft\Cryptography\OID\EncodingType,\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\,\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType" OR ((OBJECTNAME endswith "\SOFTWARE\Microsoft\Cryptography\Providers" AND isExist(OBJECTVALUENAME)) OR (OBJECTNAME endswith "\SOFTWARE\Microsoft\Cryptography\OID" AND OBJECTVALUENAME startswith "EncodingType") OR (OBJECTNAME endswith "\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers" AND isExist(OBJECTVALUENAME)) OR (OBJECTNAME endswith "\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID" AND OBJECTVALUENAME startswith "EncodingType"))) AND (OBJECTNAME contains "\Dll,\$DLL" OR (OBJECTNAME contains "\Dll,\$DLL" OR OBJECTVALUENAME contains "\Dll,\$DLL"))) AND (INFORMATION != "WINTRUST.DLL,mso.dll" AND (PROCESSNAME != "C:\Windows\System32\poqexec.exe" OR (OBJECTNAME notcontains "\CryptSIPDll" AND (OBJECTNAME notcontains "\CryptSIPDll" AND OBJECTVALUENAME notcontains "\CryptSIPDll")) OR INFORMATION != "C:\Windows\System32\PsfSip.dll")) select Action1.HOSTNAME,Action1.MESSAGE,Action1.OBJECTNAME,Action1.PROCESSNAME,Action1.PREVVAL,Action1.CHANGES