Prevent DLL injection through AppInit

This Expert rule detects the untrusted process of injecting custom DLLs into the critical processes through AppInit_DLLs registry entry. When DLL adds into this registry entry, it forces user32.dll to load the DLL module during process startup.

Note
Exploit Prevention is not supported in the ARM architecture.

Important
Make sure to validate this rule in a client test system before enforcing it wider.

Rule {
    Process {
        Include VTP_TRUST true
    }
    Target {
        Match KEY {
            Include OBJECT_NAME {
                -v "HKLMS\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS\\*_DLLs"
            }
            Include -access "CREATE WRITE DELETE REPLACE_KEY RESTORE_KEY"
        }
        Match VALUE {
            Include OBJECT_NAME {            
				-v "HKLMS\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS\\*_DLLs"
            }
            Include -access "CREATE WRITE DELETE REPLACE_KEY RESTORE_KEY"
        }
    }
}

Sections of Expert Rule in detail

Rule	Formulates the execution of commands defined within `Process` and `Target`.
Process	Executes the set of actions defined within the `Include` and `Exclude` commands. It does not take any other commands.
Include VTP_TRUST true	Checks if VTP trusts the process or file. The value is treated as Boolean. That is, a value of 1 in the match type matches only processes trusted by VTP. A value of 0 matches non-trusted processes.
Target	Executes the `Match` command.
Match KEY { Include OBJECT_NAME { -v "HKLMS\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS\\*_DLLs" } Include -access "CREATE WRITE DELETE REPLACE_KEY RESTORE_KEY"	This section controls create, edit and delete access to key data in a key object, available in the folder, `HKLMS\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS\\*_DLLs`.
Match VALUE { Include OBJECT_NAME { -v "HKLMS\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS\\_DLLs" } Include -access "CREATE WRITE DELETE REPLACE_KEY RESTORE_KEY"\\_DLLs"	This section controls create, edit and delete access to value data in a key object, available in the folder, `HKLMS\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS\\*_DLLs`.

The following actions can trigger events in the Event log page of ENS client:

accessing the hive, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
creating a key, test.DLLs
creating a DWORD value, test_DLLs
creating a key, test_DLAs

For more Expert Rules examples, visit the Trellix Github repository.

Prevent DLL injection through AppInit_DLLs

Sections of Expert Rule in detail