huntrule

Windows Registry: AppCertDlls NewName/TargetObject Creation for DLL Load Persistence

Alerts on Windows registry changes involving AppCertDlls paths that can enable malicious DLL loading for persistence.

FreeUnreviewedSigmamediumv1
title: "Windows Registry: AppCertDlls NewName/TargetObject Creation for DLL Load Persistence"
id: 5c8a3b75-e405-4905-b589-f09d852d3a28
status: test
description: This rule flags registry events where the AppCertDlls value for the Session Manager location is created or modified via a detected TargetObject or NewName path. Attackers can abuse AppCertDlls to force a malicious DLL to be loaded into separate processes, supporting persistence and potential privilege escalation. Telemetry is based on Windows registry event logs capturing TargetObject and NewName for the AppCertDlls registry path.
references:
  - http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
  - https://eqllib.readthedocs.io/en/latest/analytics/14f90406-10a0-4d36-a672-31cabe149f2f.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_new_dll_added_to_appcertdlls_registry_key.yml
author: Ilyas Ochkov, oscd.community, Huntrule Team
date: 2019-10-25
modified: 2021-11-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.009
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    - TargetObject: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls
    - NewName: HKLM\SYSTEM\CurentControlSet\Control\Session Manager\AppCertDlls
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 6aa1d992-5925-4e9f-a49b-845e51d1de01
    type: derived

What it detects

This rule flags registry events where the AppCertDlls value for the Session Manager location is created or modified via a detected TargetObject or NewName path. Attackers can abuse AppCertDlls to force a malicious DLL to be loaded into separate processes, supporting persistence and potential privilege escalation. Telemetry is based on Windows registry event logs capturing TargetObject and NewName for the AppCertDlls registry path.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.