Analytics BIOC Informational
✕

Possible DLL Hijack into a Microsoft process

An unsigned DLL was loaded into a Microsoft signed process. This DLL name is usually signed by Microsoft, which might indicate an attacker performing DLL Hijacking.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Persistence (TA0003) Privilege Escalation (TA0004) Defense Evasion (TA0005)
ATT&CK techniques: Hijack Execution Flow: DLL (T1574.001)
Detector tags: DLL Hijacking Analytics
Attacker's goals:

An attacker is attempting to load an untrusted module into a trusted context to avoid detection, gain persistence or to perform privilege escalation.

Investigative actions:

Investigate the loaded module to verify if it is malicious. Investigate if the loading process and the loaded module reside in legitimate locations.

Test period:
N/A (single event)
Deduplication:
1 Day
6 variations:
  • Possible DLL Hijack of a low entropy DLL into a Microsoft process Informational Adds Obfuscated Files or Information: Binary Padding (T1027.001)
  • Possible DLL Side-Loading into a Microsoft process from a suspicious folder Informational
  • DLL Hijack into a Microsoft process Informational
  • Possible DLL Hijack into a Microsoft development or framework related process Informational
  • Possible DLL Hijack into a Microsoft process - the DLL was extracted from an internet-downloaded archive Informational
  • Possible DLL Hijack into a Microsoft process - the DLL downloaded from an uncommon source Informational