← Back to SOC feed Coverage →

AppInitGlobalHooks-Mimikatz - Hide Mimikatz From Process Lists - file AppInitHook.dll

yara HIGH Yara-Rules
communitycredential-theft
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-31T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt detects adversaries leveraging the AppInit_DLLs registry mechanism to inject a custom AppInitHook.dll, enabling tools like Mimikatz to execute while remaining invisible in standard process lists. A SOC team should proactively search for this behavior in Azure Sentinel because it represents a sophisticated stealth technique that bypasses traditional process-based detections, allowing attackers to maintain persistence and harvest credentials undetected.

YARA Rule

rule AppInitHook {
	meta:
		description = "AppInitGlobalHooks-Mimikatz - Hide Mimikatz From Process Lists - file AppInitHook.dll"
		author = "Florian Roth"
		reference = "https://goo.gl/Z292v6"
		date = "2015-07-15"
		score = 70
		hash = "e7563e4f2a7e5f04a3486db4cefffba173349911a3c6abd7ae616d3bf08cfd45"
	strings:
		$s0 = "\\Release\\AppInitHook.pdb" ascii
		$s1 = "AppInitHook.dll" fullword ascii
		$s2 = "mimikatz.exe" fullword wide
		$s3 = "]X86Instruction->OperandSize >= Operand->Length" fullword wide
		$s4 = "mhook\\disasm-lib\\disasm.c" fullword wide
		$s5 = "mhook\\disasm-lib\\disasm_x86.c" fullword wide
		$s6 = "VoidFunc" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 500KB and 4 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 7 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the AppInitGlobalHooks-Mimikatz detection rule, including suggested filters and exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/TOOLKIT_THOR_HackTools.yar