AppCert DLLs abuse (MITRE ATT&CK T1546.009) is a Windows technique for persistence and privilege escalation. It works through a registry value that tells Windows to load a DLL into other processes.
How attackers use it
DLLs named in the AppCertDLLs value under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\ are loaded into every process that calls the common API functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW or WinExec.
MITRE compares this to Process Injection (T1055). A malicious DLL listed there gets loaded and run in the context of separate processes, which can mean higher privileges. Because ordinary process creation keeps triggering it, it also gives persistence.
How to detect it
MITRE's strategy is to link registry edits to what happens next:
- A modification of the AppCertDLLs value.
- Abnormal DLLs then loaded into standard Windows processes during process creation.
- Process creation events with injected DLLs that trace back to the recent registry change.
MITRE notes this often comes with elevated privileges and possible discovery or lateral movement activity. Sysmon event ID 13 (registry value set) and event ID 7 (image loaded) cover both halves.
How to reduce the risk
MITRE's one listed mitigation is Execution Prevention. Adversaries install new AppCert DLL binaries to use this technique, so use application control tools such as Windows Defender Application Control or AppLocker to identify and block software that should not run.
Quick check
Why is AppCertDLLs useful to an attacker for persistence?
Because the listed DLL loads into any process that calls CreateProcess and related functions, so normal system activity keeps triggering it.
