Persistence via AppInit DLLs Registry Modification

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•3

This rule detects modifications to the 'AppInit_DLLs' or 'LoadAppInit_DLLs' registry keys, which can be used by adversaries to establish persistence. When these registry keys are modified, a DLL specified in their values will be loaded into nearly every process that loads user32.dll, providing a mechanism for arbitrary code execution.