Known
The system DLLs mapped from a trusted cache, a tampering target rather than a runner.
Use it to spot a core DLL added, removed or repointed in the trusted list by diffing it with a clean baseline.
- SYSTEM
- Persistence
What It Is
KnownDLLs is the list of core system DLLs that Windows maps from a trusted cached location instead of searching for them each time a program loads them. During DLL loading, if a DLL is on this list the system uses its own copy of the known DLL and that DLL's own dependencies. The list is held in the KnownDLLs key under Session Manager in HKLM SYSTEM under CurrentControlSet\Control. This check comes early in the DLL search order, so these DLLs load from the system copy.
What It Proves
Windows loads a DLL on this list from its own trusted copy instead of searching for it, which blocks search order hijacking for that name. Removing or changing an entry exposes that name to the normal search order.
What It Does Not Prove
It is a stable list that rarely changes, so a change is the whole signal rather than the contents. Editing it safely is hard, so misuse is rare but serious.
Where It Lives
KnownDLLs lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| A normal core entry mapping ole32 from the trusted cache, which blocks search order hijacking for that name. Diff the whole list against a baseline. |
| user32 is listed as on a clean build, so it too loads only from its trusted copy. An added name, a removed core DLL or a changed target is the whole signal. |
| advapi32 is mapped from its trusted copy, as expected. Any difference from a clean baseline for build 26100 warrants a full investigation. |
How to Read It
Compare the values under KnownDLLs with a known good baseline for the Windows build. Look for an added name, a removed core DLL, or a changed target. Any difference from the baseline warrants a full investigation.
- When Windows Writes It
- It changes rarely, and a change is almost always notable.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Autoruns, Registry Explorer, RECmd
Hunt It
Microsoft does not say which keys Defender records, so confirm it records this one first. The list is stable and read at boot, so any write deserves a look but does not prove a load.
// Any write under the KnownDLLs keyDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what KnownDLLs shows.
- DLL Load, Sysmon Event 7Not in the RegistryShows which copy of a DLL a process loaded, and from which folder.
Sources
The facts on this page come from these public pages, which say more on each point.