AppInit DLLs abuse (MITRE ATT&CK T1546.010) is a Windows persistence and privilege escalation technique based on a registry value, AppInit_DLLs.
How attackers use it
DLLs named in AppInit_DLLs under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows (and the matching Wow6432Node path) are loaded by user32.dll into every process that loads user32.dll. MITRE points out that in practice this is nearly every program.
As with Process Injection, a malicious DLL here runs in the context of other processes, which can raise privileges. It also persists, since regular API activity keeps triggering it. MITRE notes the feature is disabled in Windows 8 and later when Secure Boot is enabled.
How to detect it
- A change to the
AppInit_DLLsvalue in either key. - Anomalous DLL loads in processes that import user32.dll, especially unsigned or uncommon DLLs.
How to reduce the risk
- Update software. MITRE advises upgrading to Windows 8 or later and enabling Secure Boot, which disables AppInit DLL loading.
- Use execution prevention. Adversaries install new AppInit DLL binaries, so application control tools such as Windows Defender Application Control or AppLocker can identify and block them.
Quick check
What setting makes AppInit DLLs inert on modern Windows?
Secure Boot on Windows 8 or later disables the AppInit DLL functionality.
