TA0003 · PERSISTENCE
AppInit DLLs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
Detect it with
Monitor DLL loads by processes that load user32.dll and look for DLLs that are not recognized or not normally loaded into a process. Monitor the AppInit_DLLs Registry values for modifications that do not correlate with known software, patch cycles, etc.
Why it matters on shift
AppInit DLLs is one of the concrete ways adversaries achieve persistence. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After persistence, the next tactic is usually Privilege Escalation. Search your telemetry for the transition before closing the ticket.
Kill-chain context