This detection analyzes Windows Registry activity to identify unauthorized changes to AppCertDLL registry entries, which specify DLLs loaded by the Windows Session Manager at startup. The rule uses a Splunk search over the Endpoint.Registry data model to detect Registry.action = "modified" events where Registry.registry_path matches *\Control\Session Manager\AppCertDLLs\* and Registry.registry_value_data is present. It aggregates results with firstTime/lastTime for the affected dest process and related registry fields, then applies a filter (windows_appcertdll_modification_via_registry_filter) to surface likely malicious modifications. If triggered, the finding indicates potential persistence and privilege escalation via DLL loading at system startup, which can lead to system compromise and evasion of controls. Known false positives include legitimate software updates or approved tooling that modify AppCertDLL values. The code path is aligned with Windows persistence techniques, specifically T1546.009 (Event-Triggered Execution: Registry Modification). The rule maps to Endpoint/Windows as the affected asset domain and uses Sysmon EventID 13 as the data source. Mitre and enterprise incident response teams can use the drilldown and risk views to assess impacted endpoints and correlate with other persistence indicators.