
title: New DLL Added to AppCertDlls Registry Key
author: Ilyas Ochkov, oscd.community
date: 2019/10/25
description: Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value
  in the Registry key can be abused to obtain persistence and privilege escalation
  by causing a malicious DLL to be loaded and run in the context of separate processes
  on the computer.
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_2:
    EventID: 13
  SELECTION_3:
    EventID: 14
  SELECTION_4:
    TargetObject: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls
  SELECTION_5:
    NewName: HKLM\SYSTEM\CurentControlSet\Control\Session Manager\AppCertDlls
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and (SELECTION_4 or SELECTION_5))
falsepositives:
- Unknown
fields:
- EventID
- Image
- TargetObject
- NewName
id: 6aa1d992-5925-4e9f-a49b-845e51d1de01
level: medium
logsource:
  category: registry_event
  product: windows
modified: 2020/09/06
references:
- http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
- https://eqllib.readthedocs.io/en/latest/analytics/14f90406-10a0-4d36-a672-31cabe149f2f.html
status: experimental
tags:
- attack.persistence
- attack.t1182
- attack.t1546.009
ruletype: SIGMA
