AppInit_DLLs Registry Modification for Malicious DLL Injection
Detects modifications to the 'LoadAppInit_DLLs' or 'RequireSignedAppInit_DLLs' registry values within the 'Windows NT\CurrentVersion\Windows' key. This technique is often used for persistence or to force-load a malicious DLL into processes that load user32.dll.
Cortex XDR
