AppInit DLL Registered for Process Injection
This rule detects network traffic on TCP port 445 (SMB) containing the string "AppInit_DLLs" case-insensitively. This string is associated with the AppInit_DLLs mechanism in Windows, which can be abused for process injection and persistence by loading arbitrary DLLs into user-mode processes. The rule specifically looks for this string in traffic flowing to the server on an established connection.
Suricata
