[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1574-001":3},{"item":4,"lessons":18,"controls":40,"related":68},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1574-001","T1574.001","DLL",5,"MITRE","**What attackers do.** Attackers abuse the way Windows finds and loads DLLs, for example by placing a malicious DLL where a program will look for it first or replacing a legitimate one, so their code runs inside a trusted program. This serves Persistence, Privilege Escalation and Defence Evasion.\n\n**How to defend.** Restrict write permissions on application and system directories, and use application control that covers DLLs. Enable safe DLL search mode and fix software that loads libraries from insecure paths. Endpoint tools that record image loads provide visibility.\n\n**Signs to look for.** Look for DLLs loaded from unexpected paths, unsigned DLLs in folders of signed applications, and new DLLs appearing in application directories outside updates. A common gap is not collecting image load events.","Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.\n\nSpecific ways DLLs are abused by adversaries include:\n\n### DLL Sideloading\nAdversaries may execute their own malicious payloads by side-loading DLLs. Side-loading involves hijacking which DLL a program loads by planting and then invoking a legitimate application that executes their payload(s).","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1574\u002F001\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.664+00:00",{"total":9,"list":19},[20,24,28,32,36],{"slug":21,"title":22,"published_at":23},"malicious-notepad-plugin-used-to-deliver-persistent-malware-via-dll-hijacking","Malicious Notepad++ Plugin Used to Deliver Persistent Malware via DLL Hijacking","2026-07-23T18:20:59.722+00:00",{"slug":25,"title":26,"published_at":27},"cursor-ai-editor-executes-malicious-gitexe-from-cloned-repos-without-warning","Cursor AI Editor Executes Malicious git.exe from Cloned Repos Without Warning","2026-07-15T12:21:13.328+00:00",{"slug":29,"title":30,"published_at":31},"dll-search-order-hijacking-flaw-found-in-abb-advant-master-software","DLL Search Order Hijacking Flaw Found in ABB Advant Master Software","2026-07-14T16:22:17.552+00:00",{"slug":33,"title":34,"published_at":35},"dll-hijacking-attack-abuses-microsoft-signed-executables","DLL Hijacking Attack Abuses Microsoft-Signed Executables","2026-04-08T09:08:18.033+00:00",{"slug":37,"title":38,"published_at":39},"dll-hijacking-vulnerability-enables-privilege-escalation-in-foxit-pdf-software","DLL Hijacking Vulnerability Enables Privilege Escalation in Foxit PDF Software","2026-04-02T22:09:12.325+00:00",[41,46,51,55,60,64],{"slug":42,"name":43,"problem":44,"stories":45},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",4,{"slug":47,"name":48,"problem":49,"stories":50},"patch-management","Automated patch management","Known holes get closed in days, not months.",2,{"slug":52,"name":53,"problem":54,"stories":50},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":56,"name":57,"problem":58,"stories":59},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",1,{"slug":61,"name":62,"problem":63,"stories":59},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":65,"name":66,"problem":67,"stories":59},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[69,74,79,84,88,92,96,100],{"family":70,"item":71,"code":72,"title":73,"together":45},"cis","2","Control 2","Inventory and Control of Software Assets",{"family":70,"item":75,"code":76,"title":77,"together":78},"16","Control 16","Application Software Security",3,{"family":80,"item":81,"code":82,"title":83,"together":78},"nist-800-53","ac-6","AC-6","Least Privilege",{"family":70,"item":85,"code":86,"title":87,"together":78},"10","Control 10","Malware Defenses",{"family":80,"item":89,"code":90,"title":91,"together":50},"cm-7","CM-7","Least Functionality",{"family":80,"item":93,"code":94,"title":95,"together":50},"au-12","AU-12","Audit Record Generation",{"family":70,"item":97,"code":98,"title":99,"together":50},"7","Control 7","Continuous Vulnerability Management",{"family":80,"item":101,"code":102,"title":103,"together":50},"si-3","SI-3","Malicious Code Protection"]