atomic-red-team/atomics/T1103/T1103.md

T1103 - AppInit DLLs

Description from ATT&CK

Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. (Citation: Endgame Process Injection July 2017) Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. (Citation: AppInit Registry)

The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled. (Citation: AppInit Secure Boot)

Atomic Tests

• Atomic Test #1 - Install AppInit Shim

Atomic Test #1 - Install AppInit Shim

AppInit_DLLs is a mechanism that allows an arbitrary list of DLLs to be loaded into each user mode process on the system

Supported Platforms: Windows

Inputs

Name	Description	Type	Default Value
registry_file	Windows Registry File	Path	T1103.reg

Run it with command_prompt! Elevation Required (e.g. root or admin)

reg.exe import #{registry_file}