Detect AppInit DLLs in Sumo Logic CSE
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. In practice, this is nearly every desktop process (GUI applications). This Registry-based injection mechanism has been used by multiple APT groups and crimeware families including Flame, FinFisher, and others.
MITRE ATT&CK
- Tactic
- Privilege Escalation Persistence
- Technique
- T1546 Event Triggered Execution
- Sub-technique
- T1546.010 AppInit DLLs
- Canonical reference
- https://attack.mitre.org/techniques/T1546/010/
Sumo Detection Query
(_sourceCategory=windows* OR _sourceCategory=*sysmon* OR _sourceCategory=*winlog*)
(EventCode=12 OR EventCode=13 OR EventCode=14)
("Windows NT\\CurrentVersion\\Windows")
("AppInit_DLLs" OR "LoadAppInit_DLLs" OR "RequireSignedAppInit_DLLs")
| parse regex "(?i)<Data Name='TargetObject'>(?P<TargetObject>[^<]+)</Data>"
| parse regex "(?i)<Data Name='Details'>(?P<Details>[^<]+)</Data>" nodrop
| parse regex "(?i)<Data Name='Image'>(?P<Image>[^<]+)</Data>" nodrop
| parse regex "(?i)<Data Name='User'>(?P<reg_user>[^<]+)</Data>" nodrop
| where TargetObject matches "*Windows NT*CurrentVersion*Windows*"
| where TargetObject matches "*AppInit_DLLs*"
OR TargetObject matches "*LoadAppInit_DLLs*"
OR TargetObject matches "*RequireSignedAppInit_DLLs*"
| eval is_suspicious_dll = if(
TargetObject matches "*AppInit_DLLs"
AND !(Details matches "(?i)system32" OR Details matches "(?i)syswow64")
AND Details != "", 1, 0)
| eval is_loading_enabled = if(
TargetObject matches "*LoadAppInit_DLLs" AND Details = "1", 1, 0)
| eval is_signing_disabled = if(
TargetObject matches "*RequireSignedAppInit_DLLs" AND Details = "0", 1, 0)
| where is_suspicious_dll = 1 OR is_loading_enabled = 1 OR is_signing_disabled = 1
| eval detection_type = if(is_suspicious_dll = 1, "APPINIT_SUSPICIOUS_DLL_PATH",
if(is_loading_enabled = 1, "APPINIT_LOADING_ENABLED",
if(is_signing_disabled = 1, "APPINIT_SIGNATURE_DISABLED",
"APPINIT_KEY_MODIFIED")))
| fields _time, host, reg_user, EventCode, detection_type, TargetObject, Details, Image
| sort by _time descDetects T1546.010 AppInit DLL persistence by parsing Sysmon registry event logs (Event IDs 12/13/14) in Sumo Logic. Identifies three high-risk conditions: non-system DLL paths in AppInit_DLLs, LoadAppInit_DLLs enabled (value=1), and RequireSignedAppInit_DLLs disabled (value=0). Parses XML event payload fields for actionable context.
Data Sources
Required Tables
False Positives & Tuning
- Third-party input method editors (IMEs) or keyboard layout software that inject helper DLLs into all GUI processes using AppInit_DLLs
- Enterprise DLP or data classification agents that use AppInit_DLLs for cross-process document inspection — validate against approved software inventory
- System restore or backup operations that reset registry hive snapshots containing historical AppInit_DLLs values
Other platforms for T1546.010
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Register DLL in AppInit_DLLs and Enable Loading
Expected signal: Three Sysmon Event ID 13 records: (1) AppInit_DLLs set to C:\Users\Public\argus_appinit.dll, (2) LoadAppInit_DLLs set to 1, (3) RequireSignedAppInit_DLLs set to 0. The combination of all three changes in a short time window is a high-confidence indicator.
- Test 2Enable AppInit Loading Without DLL Path
Expected signal: Sysmon Event ID 13: TargetObject contains Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs, Details=1. This single-value change is an intermediate persistence indicator.
- Test 3Audit Current AppInit_DLLs State
Expected signal: Process creation for reg.exe (multiple times) querying AppInit keys. Read-only — no modifications. Use this as a scheduled hunt query to detect pre-existing AppInit DLL registrations.
References (5)
- https://attack.mitre.org/techniques/T1546/010/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.010/T1546.010.md
- https://support.microsoft.com/en-us/topic/description-of-the-appinit-dlls-feature-in-windows-7-and-windows-server-2008-r2-aabbf40f-3e10-eadd-6260-79df3d753b5f
- https://www.mandiant.com/resources/blog/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against-israel
- https://pentestlab.blog/2019/12/12/persistence-appinit-dlls/
Unlock Pro Content
Get the full detection package for T1546.010 including response playbook, investigation guide, and atomic red team tests.