T1546.010 — AppInit DLLs

Tactics: Privilege Escalation, Persistence · Platforms: Windows

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows…

Sub-technique of Event Triggered Execution (T1546).

Sigma detection rules (1)

T1546.010 Event Triggered Execution: AppInit DLLs

title: "T1546.010 Event Triggered Execution: AppInit DLLs"
id: 69c0b492-69d0-4a67-8410-1ff929d8930d
description: 'Detection Strategy for Event Triggered Execution: AppInit DLLs (Windows). (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: ImagePathWhitelist, UserContext, TimeWindow, DLLSignatureStatus.'
references:
  - https://attack.mitre.org/techniques/T1546/010
author: Shahrukh Khan
date: 2026-01-16
license: MIT
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.010

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    CommandLine|contains|all:
      - 'AppInit_DLLs'

  condition: selection

falsepositives:
  - Legitimate compatibility-shim or accessibility software still using the deprecated AppInit_DLLs mechanism; rare in modern (post-Win8) environments where this is disabled by default with secure boot.

level: high

Related sub-techniques

Explore