What is the authoritative source for T1546.009?

AppCert DLLs (T1546.009) is catalogued in MITRE ATT&CK Enterprise and curated for EU compliance use cases by SQUR.

Which ATT&CK tactics does T1546.009 belong to?

T1546.009 (AppCert DLLs) maps to the following MITRE ATT&CK tactic(s): privilege-escalation, persistence.

T1546.009SubTechniqueprivilege-escalationpersistenceagent-callable

T1546.009AppCert DLLs

Sub-technique of T1546

Platforms: Windows

ATT&CK version: 14.1

What it is

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the <code>AppCertDLLs</code> Registry key under <code>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\</code> are loaded into every process that calls the ubiquitously used application programming interface (API) functions <code>CreateProcess</code>, <code>CreateProcessAsUser</code>, <code>CreateProcessWithLoginW</code>, <code>CreateProcessWithTokenW</code>, or <code>WinExec</code>. (Citation: Elastic Process Injection July 2017) Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), this value can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. Malicious AppCert DLLs may also provide persistence by continuously being triggered by API activity.

ATT&CK tactics· 2

Privilege Escalation Persistence

References

Sourced from MITRE ATT&CK Enterprise v14.1. Curated and contextualized for EU compliance use cases by Adam Lundqvist, Founder at SQUR.