ATT&CK technique
View on MITRE ATT&CK →
T1546.009
AppCert DLLs
Privilege EscalationPersistence
5 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Registry Persistence via AppCert DLL | production | 2026-09-18 |
| splunk | Windows AppCertDLL Modification Via Command Line | production | 2026-07-27 |
| splunk | Windows AppCertDLL Modification Via Registry | production | 2026-07-27 |
| sigma | Session Manager Autorun Keys Modification | test | 2023-08-17 |
| sigma | New DLL Added to AppCertDlls Registry Key | test | 2021-11-27 |