Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\ are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec. [1]
Similar to Process Injection, this value can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. Malicious AppCert DLLs may also provide persistence by continuously being triggered by API activity.
| ID | Name | Description |
|---|---|---|
| S0196 | PUNCHBUGGY |
PUNCHBUGGY can establish using a AppCertDLLs Registry key.[2] |
| ID | Mitigation | Description |
|---|---|---|
| M1038 | Execution Prevention |
Adversaries install new AppCertDLL binaries to execute this technique. Identify and block potentially malicious software executed through AppCertDLLs functionality by using application control [3] tools, like Windows Defender Application Control[4], AppLocker, [5] [6] or Software Restriction Policies [7] where appropriate. [8] |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0017 | Command | Command Execution |
Monitor executed commands and arguments that may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. |
| DS0011 | Module | Module Load |
Monitor DLL loads by processes, specifically looking for DLLs that are not recognized or not normally loaded into a process. Tools such as Sysinternals Autoruns may overlook AppCert DLLs as an auto-starting location. [9] [10] |
| DS0009 | Process | OS API Execution |
Monitor and analyze application programming interface (API) calls that are indicative of Registry edits, such as |
| Process Creation |
Monitor newly executed processes that may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. |
||
| DS0024 | Windows Registry | Windows Registry Key Modification |
Monitor the AppCertDLLs Registry value for modifications that do not correlate with known software, patch cycles, etc. |