AppInit_DLLs (Legacy)

• Registry value read by user32.dll: every process that loads user32 also loads DLLs listed here.
• Extremely broad, extremely noisy — a favorite of older malware.

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows
    AppInit_DLLs      = "C:\evil.dll"
    LoadAppInit_DLLs  = 1

• Now largely dead: disabled by default and blocked when Secure Boot is on (must be code-signed).
• Still worth recognizing in older samples and CTFs.