THREATNOIR
Subscribe
MITRE ATT&CK · T1574.001

DLL

MITRE · cited in 5 of our lessons

Explanation

What attackers do. Attackers abuse the way Windows finds and loads DLLs, for example by placing a malicious DLL where a program will look for it first or replacing a legitimate one, so their code runs inside a trusted program. This serves Persistence, Privilege Escalation and Defence Evasion.

How to defend. Restrict write permissions on application and system directories, and use application control that covers DLLs. Enable safe DLL search mode and fix software that loads libraries from insecure paths. Endpoint tools that record image loads provide visibility.

Signs to look for. Look for DLLs loaded from unexpected paths, unsigned DLLs in folders of signed applications, and new DLLs appearing in application directories outside updates. A common gap is not collecting image load events.

Open the technique on MITRE ATT&CK
The official text
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking. Specific ways DLLs are abused by adversaries include: ### DLL Sideloading Adversaries may execute their own malicious payloads by side-loading DLLs. Side-loading involves hijacking which DLL a program loads by planting and then invoking a legitimate application that executes their payload(s).

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.