Analytics BIOC Informational
✕

A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process

A signed DLL was loaded into a Microsoft-signed process. This DLL hash and signature vendor are rare, which might indicate an attacker performing DLL hijacking.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Persistence (TA0003) Privilege Escalation (TA0004) Defense Evasion (TA0005)
ATT&CK techniques: Hijack Execution Flow: DLL (T1574.001)
Detector tags: DLL Hijacking Analytics
Attacker's goals:

An attacker is attempting to load an untrusted module into a trusted context to avoid detection, gain persistence or to perform privilege escalation.

Investigative actions:

Investigate the loaded module to verify if it is malicious. Investigate if the loading process and the loaded module reside in legitimate locations.

Test period:
N/A (single event)
Deduplication:
1 Day
8 variations:
  • A rare DLL, signed by an uncommon vendor, was hijacked into an injected Microsoft process Medium (parent: Informational)
  • A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process which was executed by untrusted causality actor Medium (parent: Informational)
  • A rare DLL, signed by an uncommon vendor, was downloaded from an uncommon source and was loaded into Microsoft process Low (parent: Informational)
  • A rare DLL, signed by a rarely seen vendor, was hijacked into a Microsoft process Low (parent: Informational)
  • A rare and high entropy DLL, signed by an uncommon vendor, was hijacked into a Microsoft process Low (parent: Informational)
  • A rare DLL, signed by an uncommon vendor, was hijacked into a newly created Microsoft process Low (parent: Informational)
  • A rare DLL, signed by an uncommon vendor, was sideloaded into a Microsoft process Low (parent: Informational)
  • A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process which was executed by a scheduled task Low (parent: Informational)