Event Triggered Execution: AppInit DLLs
- ID
- T1546.010
- Tactics
- TA0003 Persistence, TA0004 Privilege Escalation
- Sub-technique of
- T1546 Event Triggered Execution
- Platforms
- Windows
- Data sources
- Process Creation, Module Load, Windows Registry Key Modification
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. [7]
Similar to Process Injection, these values can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. [8] Malicious AppInit DLLs may also provide persistence by continuously being triggered by API activity.
The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled. [9]
Detection
- DET0557 Detection Strategy for Event Triggered Execution: AppInit DLLs (Windows)
Data components: Process Creation, Module Load, Windows Registry Key Modification
Mitigations (2)
- M1038 Execution Prevention
Adversaries can install new AppInit DLLs binaries to execute this technique. Identify and block potentially malicious software executed through AppInit DLLs functionality by using application control [1] tools, like Windows Defender Application Control[2], AppLocker, [3] [4] or Software Restriction Policies [5] where appropriate. [6]
- M1051 Update Software
Upgrade to Windows 8 or later and enable secure boot.
Groups (1)
Software (3)
References
- Beechey 2010
- Microsoft Windows Defender Application Control
- Windows Commands JPCERT
- NSA MS AppLocker
- Corio 2008
- TechNet Applocker vs SRP
- Elastic Process Injection July 2017
- AppInit Registry
- AppInit Secure Boot