persist via AppInit_DLLs registry key

rule:
  meta:
    name: persist via AppInit_DLLs registry key
    namespace: persistence/registry/appinitdlls
    authors:
      - michael.hunhoff@fireye.com
    scopes:
      static: function
      dynamic: thread
    att&ck:
      - Persistence::Event Triggered Execution::AppInit DLLs [T1546.010]
    references:
      - https://docs.microsoft.com/en-us/windows/win32/win7appqual/appinit-dlls-in-windows-7-and-windows-server-2008-r2
    examples:
      - Practical Malware Analysis Lab 11-02.dll_:0x1000158b
  features:
    - and:
      - or:
        - match: set registry value
        - number: 0x80000002 = HKEY_LOCAL_MACHINE
      - or:
        - string: /Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows/i
        - string: /Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows/i
      - string: /AppInit_DLLs/i
      - optional:
        - string: /LoadAppInit_DLLs/i
          description: enable AppInit DLLs feature