Analytics BIOC Informational
✕

Unsigned DLL Side-Loading

A signed process loaded an unsigned and rare module from the same folder.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Persistence (TA0003) Privilege Escalation (TA0004) Defense Evasion (TA0005)
ATT&CK techniques: Hijack Execution Flow: DLL (T1574.001)
Detector tags: DLL Hijacking Analytics
Attacker's goals:

An attacker is attempting to load an untrusted module into a trusted context to avoid detection, gain persistence or to perform privilege escalation.

Investigative actions:

Investigate the loaded module to verify if it is malicious. Investigate if the loading process and the loaded module reside in legitimate locations.

Test period:
N/A (single event)
Deduplication:
1 Day
6 variations:
  • DLL Side-Loading of module bearing an invalid Microsoft signature High (parent: Informational)
  • Unsigned DLL Side-Loading to a signed microsoft process by a rare causality actor Medium (parent: Informational)
  • Unsigned DLL Side-Loading to a signed microsoft process Low (parent: Informational)
  • Unsigned DLL Side-Loading - DLL downloaded from an uncommon source Low (parent: Informational)
  • Unsigned high entropy DLL Side-Loading by untrusted causality actor Low (parent: Informational)
  • Unsigned DLL Side-Loading which was executed by a scheduled task Low (parent: Informational)