Analytics BIOC Medium
✕

Phantom DLL Loading

An attacker might leverage existing processes missing module loads to load malicious code into trusted processes.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Hijack Execution Flow: DLL (T1574.001)
Detector tags: DLL Hijacking Analytics
Attacker's goals:

An attacker is attempting to load untrusted code into trusted contexts to avoid detection, persist or escalate privileges.

Investigative actions:

Investigate the loaded module and verify if it is malicious.

Test period:
N/A (single event)
Deduplication:
1 Day
2 variations:
  • Phantom DLL Loading was used to load a DLL into a process after it was extracted from an internet-downloaded archive High (parent: Medium)
  • Phantom DLL Loading was used to load a DLL into a process after it was downloaded from an uncommon source High (parent: Medium)