Analytics BIOC Low
✕

Possible DLL Search Order Hijacking

An attacker might abuse the Windows DLL search order to trigger known, signed processes to load the attacker's malicious module.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Persistence (TA0003) Privilege Escalation (TA0004) Defense Evasion (TA0005)
ATT&CK techniques: Hijack Execution Flow: DLL (T1574.001) Hijack Execution Flow: Path Interception by PATH Environment Variable (T1574.007) Hijack Execution Flow: Path Interception by Unquoted Path (T1574.009) Hijack Execution Flow: Path Interception by Search Order Hijacking (T1574.008)
Detector tags: DLL Hijacking Analytics
Attacker's goals:

An attacker is attempting to load an untrusted module into a trusted context to avoid detection, gain persistence or to perform privilege escalation.

Investigative actions:

Investigate the loaded module to verify if it is malicious. Investigate if the loading process and the loaded module reside in legitimate locations.

Test period:
N/A (single event)
Deduplication:
1 Day
3 variations:
  • Possible DLL Search Order Hijacking by DLL Substitution Low Adds Masquerading (T1036) Masquerading: Match Legitimate Resource Name or Location (T1036.005)
  • Possible DLL Search Order Hijacking - DLL extracted from an internet-downloaded archive Low
  • Possible DLL Search Order Hijacking - DLL downloaded from an uncommon source Low