T1546.009: AppCert DLLs

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager</code> are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec.

Similar to Process Injection, this value can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. Malicious AppCert DLLs may also provide persistence by continuously being triggered by API activity.

Positive Technologies products that cover the technique

MaxPatrol SIEM knowledge base

mitre_attck_defense_evasion: PT-CR-1360: Suspicious_Registry_Value: Windows Registry abuse. This is often used by attackers for persistence, privilege escalation, lateral movement, defense evasion, data collection, and other malicious activity. mitre_attck_persistence: PT-CR-1349: AppCert_DLLs_Persist: Persistence by changing AppCertDLLs component settings

Detection

IDDS0011Data source and componentModule: Module LoadDescription

Monitor DLL loads by processes, specifically looking for DLLs that are not recognized or not normally loaded into a process. Tools such as Sysinternals Autoruns may overlook AppCert DLLs as an auto-starting location.

IDDS0009Data source and componentProcess: OS API ExecutionDescription

Monitor and analyze application programming interface (API) calls that are indicative of Registry edits, such as RegCreateKeyEx and RegSetValueEx.

IDDS0024Data source and componentWindows Registry: Windows Registry Key ModificationDescription

Monitor the AppCertDLLs Registry value for modifications that do not correlate with known software, patch cycles, etc.

IDDS0017Data source and componentCommand: Command ExecutionDescription

Monitor executed commands and arguments that may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.

IDDS0009Data source and componentProcess: Process CreationDescription

Monitor newly executed processes that may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.

Mitigation

IDM1038NameExecution PreventionDescription

Adversaries install new AppCertDLL binaries to execute this technique. Identify and block potentially malicious software executed through AppCertDLLs functionality by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.