{"id":"4f84b697-c9ed-4420-8ab5-e09af5b2345d","title":"New DLL Added to AppInit_DLLs Registry Key","description":"DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows are loaded by user32.dll into every process that loads user32.dll","author":"Ilyas Ochkov, oscd.community, Tim Shelton","status":"test","level":"medium","date":"2019-10-25","modified":"2022-12-25","tags":["attack.privilege-escalation","attack.persistence","attack.t1546.010"],"technique_ids":["T1546.010"],"logsource":{"category":"registry_event","product":"windows"},"falsepositives":["Unknown"],"references":["https://eqllib.readthedocs.io/en/latest/analytics/822dc4c5-b355-4df8-bd37-29c458997b8f.html"],"source_path":"rules/windows/registry/registry_event/registry_event_new_dll_added_to_appinit_dlls_registry_key.yml","source_sha256":"681216dd8a18ac1c1a39a097260133b08e11788403f75f540f389b8df4fe5b35","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_new_dll_added_to_appinit_dlls_registry_key.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: New DLL Added to AppInit_DLLs Registry Key\nid: 4f84b697-c9ed-4420-8ab5-e09af5b2345d\nstatus: test\ndescription: DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows are loaded by user32.dll into every process that loads user32.dll\nreferences:\n    - https://eqllib.readthedocs.io/en/latest/analytics/822dc4c5-b355-4df8-bd37-29c458997b8f.html\nauthor: Ilyas Ochkov, oscd.community, Tim Shelton\ndate: 2019-10-25\nmodified: 2022-12-25\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1546.010\nlogsource:\n    category: registry_event\n    product: windows\ndetection:\n    selection:\n        - TargetObject|endswith:\n              - '\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_Dlls'\n              - '\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_Dlls'\n        # Key Rename\n        - NewName|endswith:\n              - '\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_Dlls'\n              - '\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_Dlls'\n    filter:\n        Details: '(Empty)'\n    condition: selection and not filter\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1546.010","id":"T1546.010","name":"AppInit DLLs","page":"techniques/enterprise/T1546.010/"}],"data_path":"data/detection-rules/4f84b697-c9ed-4420-8ab5-e09af5b2345d.json","kind":"sigma"}