This hunt detects adversaries leveraging the AppInit_DLLs registry mechanism to inject a custom AppInitHook.dll, enabling tools like Mimikatz to execute while remaining invisible in standard process lists. A SOC team should proactively search for this behavior in Azure Sentinel because it represents a sophisticated stealth technique that bypasses traditional process-based detections, allowing attackers to maintain persistence and harvest credentials undetected.
rule AppInitHook {
meta:
description = "AppInitGlobalHooks-Mimikatz - Hide Mimikatz From Process Lists - file AppInitHook.dll"
author = "Florian Roth"
reference = "https://goo.gl/Z292v6"
date = "2015-07-15"
score = 70
hash = "e7563e4f2a7e5f04a3486db4cefffba173349911a3c6abd7ae616d3bf08cfd45"
strings:
$s0 = "\\Release\\AppInitHook.pdb" ascii
$s1 = "AppInitHook.dll" fullword ascii
$s2 = "mimikatz.exe" fullword wide
$s3 = "]X86Instruction->OperandSize >= Operand->Length" fullword wide
$s4 = "mhook\\disasm-lib\\disasm.c" fullword wide
$s5 = "mhook\\disasm-lib\\disasm_x86.c" fullword wide
$s6 = "VoidFunc" fullword ascii
condition:
uint16(0) == 0x5a4d and filesize < 500KB and 4 of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 7 string patterns in its detection logic.
Here are 4 specific false positive scenarios for the AppInitGlobalHooks-Mimikatz detection rule, including suggested filters and exclusions:
Scenario: Endpoint Detection & Response (EDR) Agent Initialization
AppInitHook.dll (or a similarly named DLL) as part of their kernel-mode integration logic, mimicking Mimikatz’s behavior.ProcessName IN ("FalconService.exe", "cb-sensor.exe", "SentinelOneAgent.exe") AND FilePath CONTAINS "\Program Files\EDRVendor\".Scenario: Scheduled Group Policy Deployment of Security Tools
SYSTEM account during off-hours may execute a script that temporarily registers AppInitHook.dll to perform a system-wide audit or health check before unloading it.RunTime BETWEEN (02:00 AND 06:00) AND AccountName IN ("DOMAIN\GPO-Deploy-Svc", "SYSTEM") AND CommandLine CONTAINS "gpupdate".**Scenario: Third-Party