> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/persistence/registry/appinit_dlls.md).

# AppInit\_DLLs

## Overview

* **Registry Location**: `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs`
* **Purpose and Use**: Originally designed to allow developers to load custom DLLs into the address space of all processes that load User32.dll (essentially, any application with a GUI), this feature can be used to implement global hooks, extend or modify GUI functionality, and for other legitimate system-wide enhancements.

## Abuse by Threat Actors

* **Process Injection**: Malware can use the `AppInit_DLLs` mechanism to inject malicious DLLs into all processes that load User32.dll, which includes most applications with a graphical user interface. This broad injection scope makes it a potent vector for widespread compromise.
* **Persistence and Stealth**: Malicious DLLs loaded via `AppInit_DLLs` are executed each time a GUI application starts, providing a method for persistence. Because this behavior is part of a legitimate Windows feature, it can be more difficult to detect and differentiate from normal system operations.
* **Privilege Escalation**: If a process that loads a malicious DLL via `AppInit_DLLs` runs with elevated privileges, the malicious code within the DLL can potentially execute with those same elevated privileges, leading to privilege escalation.

## Detection and Mitigation

* **Registry Monitoring**: Continuous monitoring of the `AppInit_DLLs` registry key for unauthorized changes is crucial. Any addition to this key should be scrutinized and validated.
* **Security Software**: Use security solutions that specifically check for and alert on modifications to `AppInit_DLLs`, as well as other methods of process injection. Advanced endpoint protection platforms often include behavioral analysis that can detect the anomalous activity associated with DLL injection.
* **Software Restriction Policies**: Implementing software restriction policies and application whitelisting can help prevent unauthorized DLLs from being executed, even if they are specified in the `AppInit_DLLs` registry key.
* **Least Privilege Principle**: Running applications and services with the least privilege necessary can help limit the potential impact of malicious DLLs loaded through this mechanism.

## Example of a Suspicious Entry

A potentially malicious modification to the `AppInit_DLLs` key might look like this:

```powershell
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\Windows\\System32\\malicious.dll"
```

In this example, `malicious.dll` would be loaded into every application that uses User32.dll, executing its payload in the context of multiple processes across the system.

## Conclusion

While `AppInit_DLLs` was designed for legitimate customization and extension of Windows functionalities, its potential for abuse by malware makes it a significant security concern. Protecting against threats exploiting `AppInit_DLLs` requires a combination of vigilant system monitoring, robust security practices, and the implementation of preventive security controls. Awareness of this and similar mechanisms within Windows is essential for maintaining system integrity and security.