kevmap

Techniques › T1546 › T1546.010

T1546.010 AppInit DLLs

privilege escalation · persistence — Windows · attack.mitre.org · JSON

1
MITRE detection strategy
1
analytics
1
Sigma rules tagged attack.t1546.010
0
KEV CVEs mapped here
<p>Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the <code>AppInit_DLLs</code> value in the Registry keys <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows</code> or <code>HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows</code> are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library.</p><p>Similar to Process Injection, these values can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. Malicious AppInit DLLs may also provide persistence by continuously being triggered by API activity.</p><p>The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1546.010

New DLL Added to AppInit_DLLs Registry Key mediumtest
Author: Ilyas Ochkov, oscd.community, Tim Shelton · 2019-10-25 (modified 2022-12-25) · logsource: product=windows category=registry_event · 4f84b697-c9ed-4420-8ab5-e09af5b2345d
DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll
Techniques: T1546.010

Rules tagged at the parent level (attack.t1546) 10

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

COM Hijack via Sdclt hightest
Author: Omkar Gudhate · 2020-09-27 (modified 2023-09-28) · logsource: product=windows category=registry_set · 07743f65-7ec9-404a-a519-913db7118a8d
Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'
Techniques: T1546T1548
Control Panel Items hightest
Author: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_) · 2020-06-22 (modified 2023-10-11) · logsource: product=windows category=process_creation · 0ba863e6-def5-4e50-9cea-4dd8c7dc46a4
Detects the malicious use of a control panel item
Techniques: T1218.002T1546
Suspicious Get-Variable.exe Creation hightest
Author: frack113 · 2022-04-23 · logsource: product=windows category=file_event · 0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b
Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.
Techniques: T1546T1027
Suspicious Outlook Macro Created hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-08 · logsource: product=windows category=file_event · 117d3d3a-755c-4a61-b23e-9171146d094c
Detects the creation of a macro file for Outlook.
Techniques: T1137T1008T1546
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2021-04-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · 396ae3eb-4174-4b9b-880e-dc0364d78a19
Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module
Techniques: T1137T1008T1546
MSSQL Extended Stored Procedure Backdoor Maggie hightest
Author: Denis Szadkowski, DIRT / DCSO CyTec · 2022-10-09 · logsource: product=windows service=application · 711ab2fe-c9ba-4746-8840-5228a58c3cb8
This rule detects the execution of the extended storage procedure backdoor named Maggie in the context of Microsoft SQL server
Techniques: T1546
SOURGUM Actor Behaviours hightest
Author: MSTIC, FPT.EagleEye · 2021-06-15 (modified 2022-10-09) · logsource: product=windows category=process_creation · 7ba08e95-1e0b-40cd-9db5-b980555e42fd
Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM
Techniques: T1546T1546.015
New Outlook Macro Created mediumtest
Author: @ScoubiMtl · 2021-04-05 (modified 2023-02-08) · logsource: product=windows category=file_event · 8c31f563-f9a7-450c-bfa8-35f8f32f1f61
Detects the creation of a macro file for Outlook.
Techniques: T1137T1008T1546
HAFNIUM Exchange Exploitation Activity criticaltest
Author: Florian Roth (Nextron Systems) · 2021-03-09 (modified 2023-03-09) · logsource: product=windows category=process_creation · bbb2dedd-a0e3-46ab-ba6c-6c82ae7a9aa7
Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers
Techniques: T1546T1053
Outlook Macro Execution Without Warning Setting Enabled hightest
Author: @ScoubiMtl · 2021-04-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · e3b50fa5-3c3f-444e-937b-0a99d33731cd
Detects the modification of Outlook security setting to allow unprompted execution of macros.
Techniques: T1137T1008T1546