AppInit DLL registry values set for system-wide DLL injection

1title: AppInit DLL registry values set for system-wide DLL injection2id: dbe9dbf4-da5a-4305-9fbe-e12a52bab6813status: experimental4description: |5  Matches a write to the AppInit_DLLs value, which user32.dll loads into every6  process that links it — the registry half of AN1536. The value lives under7  `...\Microsoft\Windows NT\CurrentVersion\Windows`, where the final `Windows`8  is a subkey and AppInit_DLLs is a value name inside it, so a Sysmon EventID9  13 record ends with the value name and the match is an endswith on the value,10  not on the key: an endswith stopping at `\CurrentVersion\Windows` would never11  fire. The parent key is carried in the matched tail so the term is anchored;12  `AppInit_DLLs` on its own is a short substring that collides with unrelated13  per-application keys. Both the 64-bit key and its Wow6432Node twin are14  covered by the one term because the redirection element sits to the left of15  the suffix. MITRE names AppInit_DLLs; LoadAppInit_DLLs and16  RequireSignedAppInit_DLLs are added here rather than taken from MITRE — they17  are the values that arm the mechanism and disable its signature check, and an18  adversary must usually touch them too. Note that AppInit loading is inert on19  Windows 8 and later with Secure Boot enabled, so on those hosts a hit is an20  unauthorised write that will not execute, not confirmed code execution. The21  analytic's other half — the resulting unsigned DLL appearing in EventID 722  image loads across many processes — is a correlation over MITRE's TimeWindow23  knob that Sigma cannot express, so it is not attempted. Sysmon registry24  monitoring is an allowlist of paths; confirm this key is in yours before25  reading silence as a clean result.26  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0557, not hand-written and not tested by its author. Any lab result is on this rule's own page.27references:28  - https://attack.mitre.org/techniques/T1546/01029  - https://attack.mitre.org/detectionstrategies/DET055730author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)31date: 2026-08-1632tags:33  - attack.privilege-escalation34  - attack.persistence35  - attack.t1546.01036logsource:37  category: registry_set38  product: windows39detection:40  selection:41    TargetObject|endswith:42      - '\Windows NT\CurrentVersion\Windows\AppInit_DLLs'43      - '\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs'44      - '\Windows NT\CurrentVersion\Windows\RequireSignedAppInit_DLLs'45  condition: selection46falsepositives:47  - "Hardening baselines and configuration-management runs that enforce LoadAppInit_DLLs to 0 and RequireSignedAppInit_DLLs to 1. Sysmon logs a value set even when the data is unchanged, so this rewrites on every policy refresh across the whole estate and is the loudest source by a wide margin. It is also the easiest to separate: the writing process is the policy engine and the Details field shows the enforced value."48  - "Legacy accessibility software, input-method editors and older endpoint DLP or anti-malware agents that still install themselves through AppInit_DLLs. The write happens once at install under a service account but is byte-identical to the abuse, so MITRE's ImagePathWhitelist knob is populated here from your own inventory of approved DLL paths, read off the Details field."49  - "Windows Setup, the servicing stack and image-deployment tooling provisioning a host, which write an empty AppInit_DLLs and a LoadAppInit_DLLs of 0 as part of the default configuration. These arrive as a burst at build time on every new machine."50  - "Graphics-driver, printing, VDI and remote-display vendor shims that inject a compatibility DLL this way on older platforms, typically reinstated by each driver update."51level: high