Analytics BIOC Informational
✕

Unsigned DLL Hijack into a Microsoft process

An unsigned DLL was loaded into a Microsoft signed process. It is not common for the DLL to be loaded into Microsoft processes, which might indicate an attacker performing DLL Hijacking.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Persistence (TA0003) Privilege Escalation (TA0004) Defense Evasion (TA0005)
ATT&CK techniques: Hijack Execution Flow: DLL (T1574.001)
Detector tags: DLL Hijacking Analytics
Attacker's goals:

An attacker is attempting to load an untrusted module into a trusted context to avoid detection, gain persistence or to perform privilege escalation.

Investigative actions:

Investigate the loaded module to verify if it is malicious. Investigate if the loading process and the loaded module reside in legitimate locations.

Test period:
N/A (single event)
Deduplication:
1 Day
7 variations:
  • Unsigned DLL Hijack into a recently created Microsoft process which commonly loads the module as signed Medium (parent: Informational)
  • Rare and unsigned DLL into an injected Microsoft process Medium (parent: Informational)
  • Unsigned DLL Hijack of a low entropy DLL into a Microsoft process Low (parent: Informational)
  • Unsigned DLL Hijack of a high entropy DLL into a Microsoft process Low (parent: Informational)
  • Unsigned DLL Hijack into a Microsoft process - the DLL downloaded from an uncommon source Low (parent: Informational)
  • Unsigned DLL Hijack into a recently created Microsoft process Low (parent: Informational)
  • Unsigned DLL Hijack into a Microsoft process which was executed by a scheduled task Low (parent: Informational)