Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in theAppInit_DLLs value in the Registry keysHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows orHKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library.[1]
Similar to Process Injection, these values can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.[2] Malicious AppInit DLLs may also provide persistence by continuously being triggered by API activity.
The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled.[3]
| ID | Name | Description |
|---|---|---|
| G0087 | APT39 | APT39 has used malware to set |
| S0107 | Cherry Picker | Some variants ofCherry Picker use AppInit_DLLs to achieve persistence by creating the following Registry key: |
| S0458 | Ramsay | Ramsay can insert itself into the address space of other applications using the AppInit DLL Registry key.[6] |
| S0098 | T9000 | If a victim meets certain criteria,T9000 uses the AppInit_DLL functionality to achieve persistence by ensuring that every user mode process that is spawned will load its malicious DLL, ResN32.dll. It does this by creating the following Registry keys: |
| ID | Mitigation | Description |
|---|---|---|
| M1038 | Execution Prevention | Adversaries can install new AppInit DLLs binaries to execute this technique. Identify and block potentially malicious software executed through AppInit DLLs functionality by using application control[8] tools, like Windows Defender Application Control[9], AppLocker,[10][11] or Software Restriction Policies[12] where appropriate.[13] |
| M1051 | Update Software | Upgrade to Windows 8 or later and enable secure boot. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0557 | Detection Strategy for Event Triggered Execution: AppInit DLLs (Windows) | AN1536 | Registry key modification to AppInit_DLLs value followed by anomalous DLL loading by processes importing user32.dll, especially unsigned or uncommon DLLs, suggesting unauthorized AppInit persistence or privilege escalation. |