App
DLLs loaded into every process that calls CreateProcess and related functions.
Use it to find a DLL set to load into every process that starts programs, in a key Windows does not create.
- SYSTEM
- Persistence
What It Proves
A DLL listed here is loaded into every process that calls CreateProcess, CreateProcessAsUser, WinExec or a related function. That gives broad code execution inside the many processes that start others.
What It Does Not Prove
The key does not exist by default, so its mere presence is notable. It shows what is set, not whether a given process loaded the DLL.
Where It Lives
AppCertDlls lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| No AppCertDlls key exists, the default, so no DLL loads into processes that start others. Check any Defender or Sysmon data for one created and later removed. |
| Windows booted with ControlSet001, so the absent key reflects the settings in use. Read the same path in any other ControlSet00x as well. |
How to Read It
Check whether the AppCertDlls key exists under Session Manager at all. Read each value, whose data is a DLL path loaded into processes that start programs. Any entry here deserves scrutiny, since legitimate software rarely uses it.
- When Windows Writes It
- When the key or a value is created, usually by an attacker with admin rights.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Autoruns, Registry Explorer, RECmd
Hunt It
Defender records these writes within retention. The key is absent by default, so any write is a strong signal, though not proof that a process loaded the DLL.
// Creation of or writes to the AppCertDlls keyDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what AppCertDlls shows.
- DLL Load, Sysmon Event 7Not in the RegistryShows the DLL loading into processes that start others, which the key alone does not.
Sources
The facts on this page come from these public pages, which say more on each point.