attack.t1546.010 | Detection.FYI

New DLL Added to AppInit_DLLs Registry Key

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.010 ·
Share on:

DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll

Read More
AppInit DLL Installation

Mar 26, 2024 · attack.privilege_escalation attack.persistence attack.t1546 attack.t1546.010 ·
Share on:

One persistence mechanism used by some variations of SmashJacker was an AppInit DLL. It would use a reg.exe command to create appropriate Windows Registry keys for persistence. Part of the RedCanary 2024 Threat Detection Report.

Read More