AppInit_DLLs

DLLs loaded into nearly every process that loads user32.dll, when it is enabled.

Use it to find a DLL set to load into almost every program that loads user32.dll, and whether the feature is on.

SOFTWARE
Persistence

What It Is

AppInit_DLLs is a list of DLLs that Windows loads into almost every process that loads User32.dll, the common user-interface library, which a few programs use to hook system APIs. The AppInit_DLLs value holds the DLL list and the LoadAppInit_DLLs value turns the mechanism on or off, both under the Windows NT\CurrentVersion\Windows key in HKLM SOFTWARE. From Windows 8 it is disabled when Secure Boot is on, and Microsoft does not recommend its use. The RequireSignedAppInit_DLLs value can require the listed DLLs to be code-signed.

What It Proves

A DLL listed in AppInit_DLLs is loaded into most user mode processes that load user32.dll, provided LoadAppInit_DLLs is 1. That gives broad code execution and a foothold in many processes at once.

What It Does Not Prove

Secure Boot disables this mechanism, and RequireSignedAppInit_DLLs can force signing, so it works mainly on older or misconfigured machines. The 32 bit view sits under WOW6432Node.

Where It Lives

AppInit_DLLs lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

C:\Windows\System32\config\SOFTWARE

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in AppInit_DLLs, each with what it tells you
Registry Value	What It Tells You
`AppInit_DLLs` `REG_SZ`	AppInit_DLLs is empty, so no DLL is set to load into GUI processes. An empty value is the healthy state, and any DLL path here would be high priority.
`LoadAppInit_DLLs` `REG_DWORD0x00000000 (0)`	The feature is switched off, so even a listed DLL would not load. Check the WOW6432Node copy too, which 32 bit programs read on their own.
`AppInit_DLLs (WOW6432Node)` `REG_SZ`	The 32 bit copy is empty too, so neither view loads a DLL this way. Check both keys' last write times for a change during the case days.

How to Read It

Read AppInit_DLLs, LoadAppInit_DLLs and RequireSignedAppInit_DLLs in the Windows key. LoadAppInit_DLLs set to 1 means the listed DLLs load, and 0 means the feature is off. Check the WOW6432Node copy too, and treat any DLL path here as high priority.

When Windows Writes It: When an administrator or an attacker writes the values.
Which Windows Versions: Windows XP to 11, disabled under Secure Boot
Tools That Parse It: Autoruns, Registry Explorer, RECmd

Hunt It

Sees It DirectlyDeviceRegistryEvents

Defender records these writes within retention. A hit shows the setting, not a DLL load. A non empty AppInit_DLLs with LoadAppInit_DLLs set to 1 is the dangerous pair.

KQLDefender XDR, Advanced hunting

// AppInit_DLLs or its enable flag being writtenDeviceRegistryEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where RegistryValueName in~ ("AppInit_DLLs", "LoadAppInit_DLLs", "RequireSignedAppInit_DLLs")| project Timestamp, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what AppInit_DLLs shows.

DLL Load, Sysmon Event 7Not in the RegistryShows the listed DLL loading into processes, which the setting alone does not.

Sources

The facts on this page come from these public pages, which say more on each point.