Wiki › Techniques, Tactics & Procedures (TTPs) › Execution › DLL Execution via Load Order Hijacking

DLL Execution via Load Order Hijacking

2 min read

Jump to:

Overview

DLL Execution via Load Order Hijacking is a technique where adversaries exploit the order in which Windows operating systems load Dynamic Link Libraries (DLLs) to execute malicious code. This method is used to gain code execution within a targeted process, often without triggering traditional security controls, making it valuable across multiple stages of an attack lifecycle.

Attack Objective

Achieve stealthy code execution by injecting malicious DLLs into legitimate processes
Supports stages including Initial Access, Execution, Persistence, Privilege Escalation, and Defense Evasion
Advances attacker position by enabling covert execution of payloads, maintaining footholds, or escalating privileges through trusted application contexts

How the Technique Works

Windows searches for DLLs in a predefined order when loading dependencies for applications. Adversaries place a malicious DLL with the same name as a legitimate one in a directory that is searched earlier than the legitimate DLL’s location. When the application loads the DLL, it inadvertently loads the attacker’s code, resulting in execution within the context of the trusted process.

Common Methods & Variations

Placing malicious DLLs in application directories, system paths, or user-writable locations to influence load order
Applicable in on-premises environments, endpoints, and sometimes cloud-based Windows workloads
Use of living-off-the-land binaries (LOLBins) to load hijacked DLLs versus deploying custom malicious DLLs

Indicators of Compromise (IOCs)

Unexpected DLL files in application directories or system folders
Unusual process behavior or crashes linked to DLL loading
File system changes involving DLLs with suspicious timestamps or hashes
Endpoint detection of anomalous DLL loads or process injections

Detection Strategies

Monitoring file system changes, especially in directories used for DLL loading
Behavioral detection focusing on processes loading DLLs from non-standard locations
Correlation of process execution events with unexpected DLL loads using endpoint telemetry

Mitigation & Prevention

Implement application whitelisting and restrict write permissions on directories involved in DLL loading
Use secure DLL search order settings and enable SafeDllSearchMode
Employ code signing and integrity verification for DLLs
Enforce least privilege principles to limit ability to place DLLs in sensitive locations

Response Considerations

Contain affected systems to prevent further execution of malicious DLLs
Perform forensic analysis to identify all compromised DLLs and impacted processes
Remove unauthorized DLLs and remediate affected applications or system configurations
Harden DLL loading configurations and review permissions to prevent recurrence

Related Techniques

DLL Search Order Hijacking
Process Injection
Signed Binary Proxy Execution
Persistence via DLL Side-Loading

Mapping & References

MITRE ATT&CK Tactic: Execution, Persistence, Privilege Escalation, Defense Evasion
MITRE ATT&CK Technique: DLL Search Order Hijacking (T1574.001)
Public advisories and research on DLL hijacking and Windows DLL loading mechanisms

Tags: Adversary Techniques Code Execution cyber threats Defense Evasion DLL Hijacking endpoint security Load Order Hijacking MITRE ATT&CK persistence privilege escalation