AppInit DLL registry values set for system-wide DLL injection

Siemphony@siemphonyhighT1546.010unverified

Matches a write to the AppInit_DLLs value, which user32.dll loads into every process that links it — the registry half of AN1536. The value lives under `...\Microsoft\Windows NT\CurrentVersion\Windows`, where the final `Windows` is a subkey and AppInit_DLLs is a value name inside it, so a Sysmon EventID 13 record ends with the value name and the match is an endswith on the value, not on the key: an endswith stopping at `\CurrentVersion\Windows` would never fire. The parent key is carried in the matched tail so the term is anchored; `AppInit_DLLs` on its own is a short substring that collides with unrelated per-application keys. Both the 64-bit key and its Wow6432Node twin are covered by the one term because the redirection element sits to the left of the suffix. MITRE names AppInit_DLLs; LoadAppInit_DLLs and RequireSignedAppInit_DLLs are added here rather than taken from MITRE — they are the values that arm the mechanism and disable its signature check, and an adversary must usually touch them too. Note that AppInit loading is inert on Windows 8 and later with Secure Boot enabled, so on those hosts a hit is an unauthorised write that will not execute, not confirmed code execution. The analytic's other half — the resulting unsigned DLL appearing in EventID 7 image loads across many processes — is a correlation over MITRE's TimeWindow knob that Sigma cannot express, so it is not attempted. Sysmon registry monitoring is an allowlist of paths; confirm this key is in yours before reading silence as a clean result. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0557, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceRegistryEvents| where (RegistryKey endswith "\\Windows NT\\CurrentVersion\\Windows\\AppInit_DLLs" or RegistryKey endswith "\\Windows NT\\CurrentVersion\\Windows\\LoadAppInit_DLLs" or RegistryKey endswith "\\Windows NT\\CurrentVersion\\Windows\\RequireSignedAppInit_DLLs")

Splunk · SPL

Run this as a search.

index=* (TargetObject="*\\Windows NT\\CurrentVersion\\Windows\\AppInit_DLLs" OR TargetObject="*\\Windows NT\\CurrentVersion\\Windows\\LoadAppInit_DLLs" OR TargetObject="*\\Windows NT\\CurrentVersion\\Windows\\RequireSignedAppInit_DLLs")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(registry.path) LIKE "*\\\\windows nt\\\\currentversion\\\\windows\\\\appinit_dlls" OR TO_LOWER(registry.path) LIKE "*\\\\windows nt\\\\currentversion\\\\windows\\\\loadappinit_dlls" OR TO_LOWER(registry.path) LIKE "*\\\\windows nt\\\\currentversion\\\\windows\\\\requiresignedappinit_dlls")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,registry_set,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetObject" type="pcre2">(?i)(\\Windows NT\\CurrentVersion\\Windows\\AppInit_DLLs$|\\Windows NT\\CurrentVersion\\Windows\\LoadAppInit_DLLs$|\\Windows NT\\CurrentVersion\\Windows\\RequireSignedAppInit_DLLs$)</field>    <description>AppInit DLL registry values set for system-wide DLL injection</description>    <mitre>      <id>T1546.010</id>    </mitre>  </rule></group>

At a glance

Logsource: registry_set / windows
Level: high
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: dbe9dbf4-da5a-4305-9fbe-e12a52bab681

ATT&CKT1546.010

T1546.010AppInit DLLs

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

A write to the AppInit_DLLs registry value or to the two values that control it. Any DLL listed there is loaded by user32.dll into every process that links user32.dll — very nearly every program on the machine. A system-wide injection primitive, configured by one registry write. MITRE's AN1536 asks for that modification followed by anomalous DLL loading across processes importing user32.dll. The second half needs EventID 7 joined to EventID 13 inside MITRE's TimeWindow knob, plus a signature judgement from its DLLSignatureStatus knob. Sigma joins nothing, so the rule takes the registry half alone. One caveat that changes triage: AppInit loading is inert on Windows 8 and later with Secure Boot enabled. On a modern estate a hit is an unauthorised write that will not execute — evidence of intent, not confirmed code execution.

02 · Telemetry you need

Sysmon EventID 13 via registry_set. Sysmon registry monitoring is a path allowlist; confirm this key is in yours before reading silence as a clean result. sentinel_kql is refused — no Sentinel table is modelled for this logsource.

03 · How the logic works

The path mechanics are right and worth copying. Windows is the subkey; AppInit_DLLs is a value name inside it, so a Sysmon SetValue record ends on the value name — an endswith stopping at \CurrentVersion\Windows would never fire. Carrying three parent components anchors the term, because AppInit_DLLs alone is a short substring that collides with unrelated per-application keys. And one term covers both the 64-bit key and its Wow6432Node twin, because the redirection element sits to the left of the suffix. MITRE names AppInit_DLLs; LoadAppInit_DLLs and RequireSignedAppInit_DLLs were added by the author, and the rule says so. Now the defect. The rule matches the value name and never the value data. LoadAppInit_DLLs set to 1 arms the mechanism; set to 0 disables it. RequireSignedAppInit_DLLs set to 0 removes the signature check; set to 1 restores it. AppInit_DLLs set to a path loads that DLL everywhere; set to empty, nothing. Every pair is an attacker action and its exact defensive inverse, and this rule cannot tell them apart. It fires identically when your hardening GPO sets LoadAppInit_DLLs to 0 and when an adversary sets it to 1. A detection that alerts on the defender disabling a mechanism is not detecting the mechanism. Generally: when one key carries both the safe and the dangerous configuration, the value written is the detection and the key is only the filter. That flows straight into severity. Two of the three values exist almost entirely to be written by your own configuration-management engine, and Sysmon logs a SetValue even when the data is unchanged — so a hardening baseline rewrites them on every policy refresh across the whole estate. The rule's own first false positive says exactly this and calls it "the loudest source by a wide margin". level: high against that is indefensible: the queue fills with policy refreshes and the one write that matters is buried inside them. A level contradicting the rule's own first false positive is the most common calibration failure in this corpus, and here it is in the wild. One field fixes both problems. Details is on the same EventID 13 record and carries the data written. Alert high when AppInit_DLLs gets a non-empty path, LoadAppInit_DLLs gets 1, or RequireSignedAppInit_DLLs gets 0; send the inverse writes to informational or a second rule. One thing ships alongside: the Splunk rendering compares case-sensitively, so reg add ... /v appinit_dlls arms the mechanism and is invisible to the SPL. Wazuh uses (?i), ES|QL lowercases. rule.yml is correct — Sigma's endswith is case-insensitive by specification — but the query you deploy is not the rule you wrote.

04 · Common false positives

Hardening baselines enforcing LoadAppInit_DLLs=0 and
Legacy accessibility software, IMEs and older DLP or anti-malware agents that
Windows Setup and image deployment writing the empty default at build time.
Graphics, printing and VDI vendor shims reinstated by each driver update.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0557 and never executed against a single log line.
tier_2: confirm the key is in your Sysmon allowlist, run it over history, and measure the GPO-refresh volume before setting a level.
tier_3: needs the EventID 7 image-load correlation AN1536 describes, which Sigma cannot express.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add the Details condition before this goes near a queue. Populate MITRE's ImagePathWhitelist knob from your own inventory of approved DLL paths, read off Details. MITRE's UserContext knob asks whether the writer was an admin or a standard user — useful, and not in this rule. Fix the Splunk casing.
Know the neighbours: AppCertDLLs and Image File Execution Options achieve the same injection through different keys, and this rule sees neither.

Declared by the author

Hardening baselines and configuration-management runs that enforce LoadAppInit_DLLs to 0 and RequireSignedAppInit_DLLs to 1. Sysmon logs a value set even when the data is unchanged, so this rewrites on every policy refresh across the whole estate and is the loudest source by a wide margin. It is also the easiest to separate: the writing process is the policy engine and the Details field shows the enforced value.
Legacy accessibility software, input-method editors and older endpoint DLP or anti-malware agents that still install themselves through AppInit_DLLs. The write happens once at install under a service account but is byte-identical to the abuse, so MITRE's ImagePathWhitelist knob is populated here from your own inventory of approved DLL paths, read off the Details field.
Windows Setup, the servicing stack and image-deployment tooling provisioning a host, which write an empty AppInit_DLLs and a LoadAppInit_DLLs of 0 as part of the default configuration. These arrive as a burst at build time on every new machine.
Graphics-driver, printing, VDI and remote-display vendor shims that inject a compatibility DLL this way on older platforms, typically reinstated by each driver update.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1546.010, evaluated against their registry_set events.

Share this rule

/u/siemphony/dbe9dbf4-da5a-4305-9fbe-e12a52bab681

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

AppInit DLL registry values set for system-wide DLL injection

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it