Wiki › Techniques, Tactics & Procedures (TTPs) › Persistence › DLL Search Order Hijacking for Persistence

DLL Search Order Hijacking for Persistence

2 min read

Jump to:

Overview

DLL Search Order Hijacking for Persistence is a technique where adversaries exploit the way Windows operating systems locate Dynamic Link Libraries (DLLs) to execute malicious code. By placing a malicious DLL in a location that is searched before the legitimate DLL, attackers maintain persistent access on a compromised system. This technique is commonly used during the persistence phase but can also support execution and privilege escalation.

Attack Objective

Establish and maintain persistent code execution on a target system
Supports Persistence, Execution, Privilege Escalation, and Defense Evasion stages of the attack lifecycle
Allows attackers to execute arbitrary code under the context of legitimate applications, advancing control and stealth

How the Technique Works

Windows applications load DLLs by searching directories in a specific order. Adversaries exploit this search order by placing a malicious DLL with the same name as a legitimate one in a directory that is searched earlier, causing the application to load the attacker-controlled DLL instead. This hijacking enables execution of malicious code whenever the application loads the DLL, providing a stealthy persistence mechanism.

Common Methods & Variations

Placing malicious DLLs in application directories, system folders, or user-writable locations that precede legitimate DLL paths
Targeting on-premises Windows endpoints and servers; variants may exist in cloud-hosted Windows environments
Use of living-off-the-land binaries (LOLBins) that load DLLs dynamically to evade detection versus deploying custom malicious DLLs

Indicators of Compromise (IOCs)

Unexpected DLL files in application or system directories
Unusual DLL load events or errors in system and application logs
File system modifications involving DLLs in non-standard locations
Endpoint detection of anomalous DLL loading behavior or process injection

Detection Strategies

Monitoring file system changes and DLL load events through endpoint detection and response (EDR) tools
Behavioral detection focusing on processes loading DLLs from uncommon or user-writable paths
Correlation of process execution with unexpected DLL dependencies or mismatched digital signatures

Mitigation & Prevention

Enforce strict file system permissions to prevent unauthorized DLL placement
Implement application whitelisting and code integrity policies to restrict DLL loading
Use Safe DLL Search Mode and fully qualified DLL paths where possible
Regularly audit and monitor DLL directories for unauthorized files

Response Considerations

Contain affected systems by isolating them from the network
Investigate DLL file origins, associated processes, and timeline of modifications
Remove malicious DLLs and restore legitimate files from trusted sources
Apply patches or configuration changes to prevent recurrence

Related Techniques

DLL Side-Loading
Process Injection
Registry Run Keys / Startup Folder Persistence
Hijack Execution Flow

Mapping & References

MITRE ATT&CK: T1574.002 – DLL Search Order Hijacking
Microsoft Security Guidance on DLL Search Order
Public incident reports and research on DLL hijacking persistence techniques

Tags: Attack Techniques cyber threats Defense Evasion DLL Hijacking endpoint security Execution MITRE ATT&CK persistence privilege escalation Windows Security