Suspicious New DLL Added to AppCertDlls Registry Key (via registry_event)

title: Suspicious New DLL Added to AppCertDlls Registry Key (via registry_event)
id: c82842b5-376c-58b4-b5a4-e113b874710f
status: stable
description: This rule detects Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be misused to obtain persistence and privilege escalation by causing a hostile DLL to be loaded and run in the context of separate processes on the computer.
references:
    - https://attack.mitre.org/techniques/T1546/009/
    - http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
    - https://eqllib.readthedocs.io/en/latest/analytics/14f90406-10a0-4d36-a672-31cabe149f2f.html
author: Huntrule Team
date: 2026-07-03
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1546.009
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        - TargetObject: 'HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls'
        - NewName: 'HKLM\SYSTEM\CurentControlSet\Control\Session Manager\AppCertDlls'
    condition: selection
falsepositives:
    - Unknown
level: medium