New DLL Added to AppCertDlls Registry Key
This rule detects the creation or modification of the 'AppCertDlls' registry key. Adversaries can abuse this registry key to achieve persistence and privilege escalation by causing a malicious DLL to be loaded and executed in the context of other processes. The rule specifically looks for changes to the 'HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls' key or its potential rename.
Sigma
