Description
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. (Citation: Elastic Process Injection July 2017)
Similar to Process Injection, these values can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. (Citation: AppInit Registry) Malicious AppInit DLLs may also provide persistence by continuously being triggered by API activity.
The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled. (Citation: AppInit Secure Boot)
Platforms
Mitigations (2)
Execution PreventionM1038
Adversaries can install new AppInit DLLs binaries to execute this technique. Identify and block potentially malicious software executed through AppInit DLLs functionality by using application control (Citation: Beechey 2010) tools, like Windows Defender Application Control(Citation: Microsoft Windows Defender Application Control), AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS Ap
Update SoftwareM1051
Upgrade to Windows 8 or later and enable secure boot.
Threat Groups (1)
| ID | Group | Context |
|---|---|---|
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) has used malware to set <code>LoadAppInit_DLLs</code> in the Registry key <code>SOFTWARE\Microsoft\Wind... |
Associated Software (3)
| ID | Name | Type | Context |
|---|---|---|---|
| S0098 | T9000 | Malware | If a victim meets certain criteria, [T9000](https://attack.mitre.org/software/S0098) uses the AppInit_DLL functionality to achieve persistence by ensu... |
| S0107 | Cherry Picker | Malware | Some variants of [Cherry Picker](https://attack.mitre.org/software/S0107) use AppInit_DLLs to achieve persistence by creating the following Registry k... |
| S0458 | Ramsay | Malware | [Ramsay](https://attack.mitre.org/software/S0458) can insert itself into the address space of other applications using the AppInit DLL Registry key.(C... |
References
- Hosseini, A. (2017, July 18). Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques. Retrieved December 7, 2017.
- Microsoft. (2006, October). Working with the AppInit_DLLs registry value. Retrieved July 15, 2015.
- Microsoft. (n.d.). AppInit DLLs and Secure Boot. Retrieved July 15, 2015.
- Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.
Frequently Asked Questions
What is T1546.010 (AppInit DLLs)?
T1546.010 is a MITRE ATT&CK technique named 'AppInit DLLs'. It belongs to the Privilege Escalation, Persistence tactic(s). Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the...
How can T1546.010 be detected?
Detection of T1546.010 (AppInit DLLs) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1546.010?
There are 2 documented mitigations for T1546.010. Key mitigations include: Execution Prevention, Update Software.
Which threat groups use T1546.010?
Known threat groups using T1546.010 include: APT39.