Sub-technique of T1546 Event Triggered Execution.View on attack.mitre.org
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\ are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec.
Similar to Process Injection, this value can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. Malicious AppCert DLLs may also provide persistence by continuously being triggered by API activity.
Rules on DetectionCode tagged with T1546.009.
| Rule | Level | Log source |
|---|---|---|
| New DLL Added to AppCertDlls Registry Key | medium | windows / registry_event |
| Session Manager Autorun Keys Modification | medium | windows / registry_set |
| Rule | Type | Risk | Data source |
|---|---|---|---|
| Windows AppCertDLL Modification Via Command Line | Anomaly | NULL | Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 |
| Windows AppCertDLL Modification Via Registry | Anomaly | NULL | Sysmon EventID 13 |
None recorded.
None recorded.
| Used by | Procedure example |
|---|---|
| MalwarePUNCHBUGGY | PUNCHBUGGY can establish using a AppCertDLLs Registry key. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
