New DLL Added to AppInit_DLLs Registry Key

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•22

This rule detects modifications to the AppInit_DLLs registry key, which can be used by adversaries to establish persistence or elevate privileges. DLLs specified in this key are loaded by user32.dll into nearly every process that loads user32.dll. The rule specifically looks for changes to the 'AppInit_Dlls' value within the 'HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows' and 'HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows' registry paths, excluding empty values.