Cross-source coverage
T1103 / ATT&CK
AppInit DLLs
ATT&CK has retired this technique. Rules still tag it; the current id is T1546.010 Event Triggered Execution: AppInit DLLs.
3 rules · 2 families across 2 sources.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. Similar to Process Injection, these values can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.
The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled.
- Tactics
- Persistence · Privilege Escalation
- Platforms
- Windows
- Telemetry
- —
socfortress/Wazuh-Rules
2 rules · 1 family| Detection | Severity | Format |
|---|---|---|
| Sysmon - Event 1: Process creation · Credential Dumping (T1103) 2 variants | Low | Wazuh XML |
| Sysmon - Event 1: Process creation · Credential Dumping (T1103) 2 variants | Low | Wazuh XML |
chronicle/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| appinit_dll_hijacking_sysmon_behaviour | Undefined | YARA-L |