GitHub Repo

Detection: Windows AppCertDLL Modification Via Registry

Updated Date: 2026-07-27 ID: 547d98dd-6d6e-4aa4-be91-a1a119f48df3 Author: Nasreddine Bencherchali, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

This analytic detects attempts to modify AppCertDLL registry entries. Values under this registry entry are used to specify DLLs loaded by the Windows Session Manager. Such modifications can be abused by attackers to load malicious code early in the system startup process, enabling persistent malware execution with high privileges. If confirmed malicious, this behavior may lead to system compromise, persistence, and the evasion of security controls.

 1
 2| tstats `security_content_summariesonly`
 3  count min(_time) as firstTime
 4        max(_time) as lastTime
 5
 6FROM datamodel=Endpoint.Registry WHERE
 7
 8Registry.action = "modified"
 9Registry.registry_path= "*\\Control\\Session Manager\\AppCertDLLs\\*"
10Registry.registry_value_data = "*"
11
12by Registry.action Registry.dest Registry.process_guid Registry.process_id
13   Registry.registry_hive Registry.registry_path Registry.registry_key_name
14   Registry.registry_value_data Registry.registry_value_name
15   Registry.registry_value_type Registry.status
16   Registry.user Registry.vendor_product
17
18
19| `drop_dm_object_name(Registry)`
20
21| where isnotnull(registry_value_data)
22
23| `security_content_ctime(firstTime)`
24
25| `security_content_ctime(lastTime)`
26
27| `windows_appcertdll_modification_via_registry_filter`

Data Source

Name Platform Sourcetype Source
Sysmon EventID 13 Windows icon Windows 'XmlWinEventLog' 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

Macros Used

Name Value
security_content_ctime convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)
windows_appcertdll_modification_via_registry_filter search *
windows_appcertdll_modification_via_registry_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1546.009 AppCert DLLs Persistence
Exploitation
Installation
DE.AE
CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Finding (Notable) No
Creates Intermediate Finding (Risk Event) Yes
Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709

Known False Positives

Modifications to AppCertDLL entries may be made by legitimate software updates or trusted system management tools. Review changes to ensure they are from approved sources.

Associated Analytic Story

Intermediate Findings

Message Entity Field Entity Type Risk Score
Potential AppCertDLL modification with value [$registry_value_data$] activity observed on [$dest$] dest system 20

Threat Objects

Field Type
registry_value_data registry_value_text

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset XmlWinEventLog:Microsoft-Windows-Sysmon/Operational XmlWinEventLog
Integration ✅ Passing Dataset XmlWinEventLog:Microsoft-Windows-Sysmon/Operational XmlWinEventLog

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1