New DLL Added to AppCertDlls Registry Key
Last updated on:
In this page
Rule name | Rule type | Log sources | MITRE ATT&CK tags | Severity |
|---|---|---|---|---|
New DLL Added to AppCertDlls Registry Key | Standard | Windows, Sysmon | Persistence: Event Triggered Execution - AppCert DLLs (T1546.009) | Critical |
About the rule
Rule Type
Standard
Rule Description
Detects the addition of a new DLL to the AppCertDlls registry key. DLLs specified in this key are loaded by every process that calls Win32 API functions such as CreateProcess or WinExec.
Why this rule?
This registry modification enables persistent code execution by forcing every process to load a malicious DLL, giving attackers widespread system access. The AppCertDlls technique is a known persistence mechanism that can survive reboots and affect all applications. Detecting this change is critical as it indicates an attacker has already gained elevated privileges and is establishing long-term access.
Severity
Trouble
Rule journey
Attack chain scenario
Execution → Persistence → Registry Modification (AppCertDlls) → DLL Injection → Widespread Code Execution.
Impact
Establishment of widespread persistence across the operating system and code execution within the context of other applications.
Rule Requirement
Prerequisites
Enable Registry auditing for the path: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls.
Criteria
Action1:
actionname = "Registry Event" AND (OBJECTNAME contains "\Session Manager\AppCertDlls")
select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.OBJECTNAME,Action1.OBJECTVALUENAME,Action1.ACCESSES,Action1.USERNAME,Action1.DOMAIN,Action1.PREVVAL,Action1.CHANGES,Action1.INFORMATION
Detection
Execution Mode
realtime
Log Sources
Windows
MITRE ATT&CK
Persistence: Event Triggered Execution - AppCert DLLs (T1546.009), Privilege Escalation: Event Triggered Execution - AppCert DLLs (T1546.009)
Author
@Ilyas Ochkov, oscd.community
Future actions
Known False Positives
Legitimate security software or specialized enterprise monitoring tools that use AppCertDlls for process monitoring.
Next Steps
- Identification: Identify the DLL file path added to the registry key.
- Analysis: Locate the file on disk and check its hash/signature.
- Response: Remove the registry value and quarantine the DLL if unauthorized.
Mitigation
ID | Mitigation | Description |
|---|---|---|
Adversaries install new AppCertDLL binaries to execute this technique. Identify and block potentially malicious software executed through AppCertDLLs functionality by using application control [3] tools, like Windows Defender Application Control[4], AppLocker, [5][6] or Software Restriction Policies [7] where appropriate. [8] |
