Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

New DLL Added to AppInit_DLLs Registry Key

DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Ilyas Ochkov, oscd.community, Tim SheltonCreated Fri Oct 25Updated Sun Dec 254f84b697-c9ed-4420-8ab5-e09af5b2345dwindows
Log Source
WindowsRegistry Event
ProductWindows← raw: windows
CategoryRegistry Event← raw: registry_event

Events for Windows Registry modifications including key creation, modification, and deletion.

Detection Logic
Detection Logic2 selectors
detection:
    selection:
        - TargetObject|endswith:
              - '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_Dlls'
              - '\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_Dlls'
        # Key Rename
        - NewName|endswith:
              - '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_Dlls'
              - '\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_Dlls'
    filter:
        Details: '(Empty)'
    condition: selection and not filter
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
eqllib.readthedocs.io
MITRE ATT&CK
Rule Metadata
Rule ID
4f84b697-c9ed-4420-8ab5-e09af5b2345d
Status
test
Level
medium
Type
Detection
Created
Fri Oct 25
Modified
Sun Dec 25
Author
Ilyas Ochkov, oscd.community, Tim Shelton
Path
rules/windows/registry/registry_event/registry_event_new_dll_added_to_appinit_dlls_registry_key.yml
Raw Tags
attack.privilege-escalationattack.persistenceattack.t1546.010
View on GitHub