Detect AppCert DLLs in Microsoft Sentinel
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKLM\System\CurrentControlSet\Control\Session Manager are loaded into every process that calls the commonly used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec. This provides adversaries a way to have code execute in the security context of every process on the system, including processes with high privilege levels.
MITRE ATT&CK
- Tactic
- Privilege Escalation Persistence
- Technique
- T1546 Event Triggered Execution
- Sub-technique
- T1546.009 AppCert DLLs
- Canonical reference
- https://attack.mitre.org/techniques/T1546/009/
KQL Detection Query
let AppCertReg = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has "System\\CurrentControlSet\\Control\\Session Manager\\AppCertDlls"
| where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
| extend DllPath = RegistryValueData
| extend IsSystemDll = RegistryValueData has_any (
"C:\\Windows\\system32\\",
"C:\\Windows\\SysWOW64\\"
)
| project RegTime=Timestamp, DeviceName, AccountName, RegistryKey,
RegistryValueName, DllPath, IsSystemDll,
InitiatingProcessFileName, InitiatingProcessCommandLine;
let AppCertDllLoad = DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FolderPath !has_any ("system32", "SysWOW64", "Program Files", "Program Files (x86)")
| join kind=inner (
DeviceRegistryEvents
| where RegistryKey has "AppCertDlls"
| distinct RegistryValueData
) on $left.FileName == $right.RegistryValueData
| project LoadTime=Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName;
union (AppCertReg | extend EventType="REGISTRATION"),
(AppCertDllLoad | extend EventType="DLL_LOADED", RegistryKey="", RegistryValueName="")
| sort by RegTime desc, LoadTime descDetects AppCert DLL persistence via two vectors: (1) registry modification to HKLM\System\CurrentControlSet\Control\Session Manager\AppCertDlls adding new DLL entries, and (2) DLL image load events where a DLL matching a registered AppCertDlls entry is loaded from a non-system path. The registry modification vector is the primary detection. Any DLL added to AppCertDlls will inject into every process that creates child processes — making this a system-wide code injection mechanism.
Data Sources
Required Tables
False Positives & Tuning
- Digital rights management (DRM) or software licensing tools that use AppCertDLLs to inject into processes for license validation
- Enterprise endpoint management agents that use AppCertDLLs for process monitoring across all applications
- Anticheat software for games that injects monitoring DLLs via AppCertDLLs mechanism
- Legacy application compatibility shims that use AppCertDLLs to apply compatibility fixes to processes
Other platforms for T1546.009
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Register DLL in AppCertDlls Registry Key
Expected signal: Sysmon Event ID 13: TargetObject=HKLM\System\CurrentControlSet\Control\Session Manager\AppCertDlls\ArgusTestDll, Details=C:\Users\Public\argus_appcert_test.dll. Security Event ID 4657 if registry auditing enabled.
- Test 2Query Existing AppCertDlls Registrations
Expected signal: Process creation for reg.exe with query arguments for the AppCertDlls key. Registry access events if object access auditing is enabled. The output reveals all currently registered DLLs.
- Test 3Create and Register AppCert DLL for Process Injection
Expected signal: File creation event for argus_appcert.dll in Public folder. Sysmon Event ID 13 for AppCertDlls registry key modification. Subsequently, Sysmon Event ID 7 records showing the DLL loaded by various processes that call CreateProcess (e.g., cmd.exe spawning children).
References (4)
- https://attack.mitre.org/techniques/T1546/009/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.009/T1546.009.md
- https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-windows
- https://pentestlab.blog/2019/12/16/persistence-appcert-dlls/
Unlock Pro Content
Get the full detection package for T1546.009 including response playbook, investigation guide, and atomic red team tests.