MITRE ATT&CKsub-technique

T1546.009 AppCert DLLs

Published 2020-01-24 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Privilege Escalation, Persistence
Platforms
Windows
Version
1.1
Created
2020-01-24

Description

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\ are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec. Similar to Process Injection, this value can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. Malicious AppCert DLLs may also provide persistence by continuously being triggered by API activity.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1546 Event Triggered Execution technique

Tactic · MITRE ATT&CK (2)

  • TA0003 Persistence tactic
  • TA0004 Privilege Escalation tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1038 Execution Prevention mitigation

Referenced by MITRE ATT&CK · uses (1)

  • S0196 PUNCHBUGGY software (malware)

Referenced by Compliance · mitigates (4)

  • CIS-2.6 Allowlist Authorized Libraries CIS Safeguard v8.1
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References