Windows Registry: AppCertDlls NewName/TargetObject Creation for DLL Load Persistence
Alerts on Windows registry changes involving AppCertDlls paths that can enable malicious DLL loading for persistence.
- Product
- windows
- Category
- registry_event
- Author
- Ilyas Ochkov, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-10-25
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry events where the AppCertDlls value for the Session Manager location is created or modified via a detected TargetObject or NewName path. Attackers can abuse AppCertDlls to force a malicious DLL to be loaded into separate processes, supporting persistence and potential privilege escalation. Telemetry is based on Windows registry event logs capturing TargetObject and NewName for the AppCertDlls registry path.
Reporting behind it
- hexacorn.comhttp://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
- eqllib.readthedocs.iohttps://eqllib.readthedocs.io/en/latest/analytics/14f90406-10a0-4d36-a672-31cabe149f2f.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_new_dll_added_to_appcertdlls_registry_key.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: AppCertDlls NewName/TargetObject Creation for DLL Load Persistence"
id: 5c8a3b75-e405-4905-b589-f09d852d3a28
status: test
description: This rule flags registry events where the AppCertDlls value for the Session Manager location is created or modified via a detected TargetObject or NewName path. Attackers can abuse AppCertDlls to force a malicious DLL to be loaded into separate processes, supporting persistence and potential privilege escalation. Telemetry is based on Windows registry event logs capturing TargetObject and NewName for the AppCertDlls registry path.
references:
- http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
- https://eqllib.readthedocs.io/en/latest/analytics/14f90406-10a0-4d36-a672-31cabe149f2f.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_new_dll_added_to_appcertdlls_registry_key.yml
author: Ilyas Ochkov, oscd.community, Huntrule Team
date: 2019-10-25
modified: 2021-11-27
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1546.009
logsource:
category: registry_event
product: windows
detection:
selection:
- TargetObject: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls
- NewName: HKLM\SYSTEM\CurentControlSet\Control\Session Manager\AppCertDlls
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 6aa1d992-5925-4e9f-a49b-845e51d1de01
type: derived