attack.t1546.009 | Detection.FYI

New DLL Added to AppCertDlls Registry Key

Aug 12, 2024 · attack.persistence attack.t1546.009 ·
Share on:

Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.

Read More
Session Manager Autorun Keys Modification

Aug 12, 2024 · attack.persistence attack.t1547.001 attack.t1546.009 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More