DLL Planting and KnownDLLs

https://blogs.msdn.microsoft.com/larryosterman/2004/07/19/what-are-known-dlls-anyway/
https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html
#caches commonly used system dlls. Originally added for performance but can be used to kinda-sorta prevent DLL planting
#all DLLs statically linked with a known DLL also get listed in \KnownDLLS
#knowndlls are expected to exist in path pointed to by HKLM\System\CCS\Control\KnownDLLs\DllDirectory
#HKLM\System\CCS\Control\Session Manager\ExcludeFromKnownDlls to exclude
$data += [PSObject] @{Path='HKLM:\System\CurrentControlSet\Control\Session Manager\KnownDLLs'; Entries='*'}
#example: mirabilis icq inet
HKEY_CURRENT_USER\Software\Mirabilis\ICQ\Agent\Apps\