T1546.009 — AppCert DLLs

Tactics: Privilege Escalation, Persistence · Platforms: Windows

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session…

Sub-technique of Event Triggered Execution (T1546).

Sigma detection rules (1)

T1546.009 Event Triggered Execution: AppCert DLLs

title: "T1546.009 Event Triggered Execution: AppCert DLLs"
id: b4f2f355-624a-4a1a-b9da-a98e916dd2a1
description: 'Detection Strategy for AppCert DLLs Persistence via Registry Injection. (Data Component: Windows Registry Key Modification; baseline tier: windows-eventid.) Tune using: TargetObject, ImageLoaded, ParentImage, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1546/009
author: Shahrukh Khan
date: 2026-06-21
license: MIT
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.009

logsource:
  category: registry_set
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 13
    TargetObject|endswith: '\Session Manager\AppCertDLLs'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - Legitimate application compatibility shims or endpoint security software registering AppCertDLLs entries.

level: medium

Related sub-techniques

Explore