Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Registry Persistence via AppInit DLL

AppInit DLLs are dynamic-link libraries (DLLs) that are loaded into every process that creates a user interface (loads user32.dll) on Microsoft Windows operating systems. The AppInit DLL mechanism is used to load custom code into user-mode processes, allowing for the customization of the user interface and the behavior of Windows-based applications. Attackers who add those DLLs to the registry locations can execute code with elevated privileges, similar to process injection, and provide a solid and constant persistence on the machine.

ATT&CK coverage

Persistence

Detection requirements

Log source category: event_index

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.