New DLL Added to AppCertDlls Registry Key

Severity: medium
Author: Ilyas Ochkov, oscd.community
Source: upstream

Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1546.009` Event Triggered Execution: AppCert DLLs
Privilege Escalation	`T1546.009` Event Triggered Execution: AppCert DLLs

Event coverage

Provider	Event ID	Title
Sysmon	12	RegistryEvent (Object create and delete)
Sysmon	13	RegistryEvent (Value Set)
Sysmon	14	RegistryEvent (Key and Value Rename)

Stages and Predicates

Stage 1: `selection`

or:
NewName: 'HKLM\SYSTEM\CurentControlSet\Control\Session Manager\AppCertDlls'
TargetObject: 'HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.