Get in touch
← Sentinel Explorer
↳ GitHub sourceAnalytics ruleMedium

Registry Persistence via AppCert DLL Modification

View on GitHub ↗Original file ↗

Description

'Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\ are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec. Ref: https://attack.mitre.org/techniques/T1546/009/'
Rule type
Scheduled
Version
1.0.3
Declared status
Available
Query frequency
1h
Query period
1h
Trigger
gt 0

Declared MITRE coverage

PersistenceT1546.009

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

SecurityEventsWindowsSecurityEvents

Data types

SecurityEvent

KQL query

Original query, unchanged.

Event
| where EventLog =~ "Microsoft-Windows-Sysmon/Operational" and EventID in (13)
| parse EventData with * 'TargetObject">' TargetObject "<" * 'Details">' Details "<" * 
| where TargetObject has ("\\Control\\Session Manager\\AppCertDLLs\\")
| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by EventID, Computer,  TargetObject, Details
| extend HostName = iif(Computer has '.',substring(Computer,0,indexof(Computer,'.')),Computer) , DnsDomain = iif(Computer has '.',substring(Computer,indexof(Computer,'.')+1),'')

Declared entities

RegistryKeyHost

Related content

Links established from declared identifiers and solution manifests.

Solutions1
Connectors2

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
c61ad0ac-ad68-4ebb-b41a-74296d3e0044
Additional source files 3Solutions/Endpoint Threat Protection Essentials/Analytic Rules/RegistryPersistenceViaAppCertDLLModification.yamlsource ↗Detections/SecurityEvent/RegistryPersistenceViaAppCertDLLModification.yamlmigration-note ↗Solutions/Endpoint Threat Protection Essentials/Data/Solution_EndpointThreatProtectionEssentials.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.