What attackers do. Attackers place a malicious DLL next to a legitimate, often signed, application so that the application loads it when it starts. The trusted program then runs the attacker's code, which helps with Defence Evasion, Persistence and sometimes Privilege Escalation.
How to defend. Use application control that covers DLLs, not just executables, and restrict write access to application folders. Monitor for legitimate signed binaries being copied to unusual locations such as user profile or temp directories. Endpoint tools that record image loads make this technique visible.
Signs to look for. Watch for signed executables running from user-writable folders, unsigned DLLs loaded by signed processes, and a DLL with a well-known name found outside its usual system path. A frequent gap is that DLL load events are not collected because of their volume.