Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

AppInit DLL Registered for Process Injection

Darshan Thummar@Mighty

•updated Jun 13, 2026•0•0•5

Detects AppInit_DLLs registry modification for persistent DLL injection

Microsoft Sentinel (KQL)

Tags

T1546.009 - AppCert DLLs T1546.010 - AppInit DLLs TA0004 - Privilege Escalation TA0003 - Persistence Registry Value Modification Windowskql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?