Applied Cybernetics Group
T1546.010 AppInit DLLs
- Technique
T1546.010- Tactics
- Privilege Escalation, Persistence
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 1
- Elastic, Splunk
- 1
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1546/010
MITRE description
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the <code>AppInit_DLLs</code> value in the Registry keys <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows</code> or <code>HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows</code> are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library.(Citation: Elastic Process Injection July 2017) Similar to Process Injection, these values can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.(Citation: AppInit Registry) Malicious AppInit DLLs may also provide persistence by continuously being triggered by API activity. The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled.(Citation: AppInit Secure Boot)
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-08-13Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them
Detection coverage
SigmaHQ community rules
Elastic and Splunk rules
- Registry Persistence via AppInit DLL (elastic)