DLL registered under the AppCertDLLs registry key

1title: DLL registered under the AppCertDLLs registry key2id: ecf2604e-06b6-4ed7-b24f-fdc0a7d88f5a3status: experimental4description: |5  Matches a write beneath the AppCertDLLs key under6  `HKLM\System\CurrentControlSet\Control\Session Manager\`, whose contents are7  loaded into every process that calls the CreateProcess family or WinExec —8  the registry half of AN1029. AppCertDLLs is a key, not a value: the DLL path9  an operator installs is an arbitrarily named value one level beneath it, so a10  real write produces a TargetObject ending in11  `\Session Manager\AppCertDLLs\<ValueName>`. The match is therefore a contains12  on `\Session Manager\AppCertDLLs\` including the trailing separator, which13  catches the write whatever the operator names the value; an endswith on the14  key name itself would only match a value literally called AppCertDLLs sitting15  directly under Session Manager, which is not how this mechanism works.16  Unlike the AppInit_DLLs value used by the sibling T1546.010 rule, Session17  Manager lives under HKLM\SYSTEM, which WOW64 does not redirect, so there is no18  Wow6432Node twin to also cover. The two techniques are siblings but not the19  same shape: AppInit_DLLs is loaded by user32.dll into GUI processes, while20  AppCertDLLs is loaded by the kernel32 process-creation path itself, so it21  reaches console and service processes that AppInit never touches, and this22  rule targets that key specifically rather than reusing AppInit's selector. The23  brief maps this from Security EventID 4657 onto Sigma's registry_set category,24  which is Sysmon-shaped (TargetObject); that is the vocabulary chosen here, and25  a deployment relying on 4657 alone — which needs Audit Registry auditing and a26  SACL on this key, neither on by default — would need ObjectName/ObjectValueName27  mapped onto TargetObject first. The analytic's DLL-load correlation (linking28  the write to a subsequent unexpected module load) needs a cross-event join29  Sigma cannot express and is not attempted. Sysmon registry monitoring is an30  allowlist of paths; confirm this key is included before reading silence as a31  clean result.32  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0362, not hand-written and not tested by its author. Any lab result is on this rule's own page.33references:34  - https://attack.mitre.org/techniques/T1546/00935  - https://attack.mitre.org/detectionstrategies/DET036236author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)37date: 2026-08-1638tags:39  - attack.privilege-escalation40  - attack.persistence41  - attack.t1546.00942logsource:43  category: registry_set44  product: windows45detection:46  selection:47    TargetObject|contains: '\Session Manager\AppCertDLLs\'48  condition: selection49falsepositives:50  - "Long-lived enterprise images still carrying a legacy antivirus or host intrusion-prevention suite from a vendor generation (pre-Windows 10 era McAfee/Symantec builds are the well-known examples) that hooked process creation through AppCertDLLs before AppInit and AMSI became the preferred mechanism; the value is set once at install and rarely touched again."51  - "Application-compatibility or license-enforcement shims from older enterprise packaging tools that register a process-creation hook here to monitor launches for compatibility or license-compliance checks — uncommon, but a real and documented legitimate use of this exact key."52  - "Endpoint management, asset-inventory and EDR agents writing or clearing their own value under this key during install, upgrade or repair, which produces the same event as an operator installing one and is distinguishable only by the DLL path and the writing process."53level: high