Detection Strategies DET0557 — Detection Strategy for Event Triggered Execution: AppInit DLLs (Windows)

DET0557

Detection Strategy for Event Triggered Execution: AppInit DLLs (Windows)

1 analytic(s) · 1 technique(s) detected

Analytics

AN1536 Analytic 1536

Windows

Registry key modification to AppInit_DLLs value followed by anomalous DLL loading by processes importing user32.dll, especially unsigned or uncommon DLLs, suggesting unauthorized AppInit persistence or privilege escalation.

WinEventLog:Sysmon EventCode=1 WinEventLog:Sysmon EventCode=7 WinEventLog:Sysmon EventCode=13, 14

[ImagePathWhitelist] Paths or filenames of known-good DLLs to exclude from alerting

[UserContext] Context of the user modifying the registry key (e.g., admin vs standard user)

[TimeWindow] Temporal threshold for correlating registry modification and DLL load

[DLLSignatureStatus] Filter or flag unsigned or suspiciously signed DLLs

Detected Techniques

Privilege Escalation (1)

T1546.010 AppInit DLLs

Details

MITRE ID: DET0557
STIX ID: x-mitre-detection-strategy--6f59bdfc-8352-4e6f-bef1-cc59b4e9b04d
Analytics: 1
Techniques Detected: 1
By Tactic