[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1574-002":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"mitre-attack","t1574-002","T1574.002","DLL Side-Loading",24,"MITRE","**What attackers do.** Attackers place a malicious DLL next to a legitimate, often signed, application so that the application loads it when it starts. The trusted program then runs the attacker's code, which helps with Defence Evasion, Persistence and sometimes Privilege Escalation.\n\n**How to defend.** Use application control that covers DLLs, not just executables, and restrict write access to application folders. Monitor for legitimate signed binaries being copied to unusual locations such as user profile or temp directories. Endpoint tools that record image loads make this technique visible.\n\n**Signs to look for.** Watch for signed executables running from user-writable folders, unsigned DLLs loaded by signed processes, and a DLL with a well-known name found outside its usual system path. A frequent gap is that DLL load events are not collected because of their volume.",null,"https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1574\u002F002\u002F","Open the technique on MITRE ATT&CK","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"ashvein-rat-targets-ukrainian-officials-via-html-concealed-commands-and-institutional-impersonation","ASHVEIN RAT Targets Ukrainian Officials via HTML-Concealed Commands and Institutional Impersonation","2026-10-08T17:20:25.103+00:00",{"slug":23,"title":24,"published_at":25},"fake-chatgpt-custom-gpts-used-to-spread-remote-access-trojans-via-clickfix-lures","Fake ChatGPT Custom GPTs Used to Spread Remote Access Trojans via ClickFix Lures","2026-09-30T16:22:19.003+00:00",{"slug":27,"title":28,"published_at":29},"fake-chatgpt-custom-gpt-delivers-rat-via-eight-stage-clickfix-attack","Fake ChatGPT Custom GPT Delivers RAT via Eight-Stage ClickFix Attack","2026-09-29T12:21:55.079+00:00",{"slug":31,"title":32,"published_at":33},"needymantis-malware-exploits-daemon-tools-supply-chain-compromise","NeedyMantis Malware Exploits Daemon Tools Supply Chain Compromise","2026-09-29T10:20:21.606+00:00",{"slug":35,"title":36,"published_at":37},"needymantis-malware-enables-stealthy-long-term-persistence-via-dll-sideloading","NeedyMantis Malware Enables Stealthy Long-Term Persistence via DLL Sideloading","2026-09-28T22:21:46.583+00:00",{"slug":39,"title":40,"published_at":41},"bambootoken-malware-hijacks-legitimate-software-to-establish-covert-c2-via-mqtt","BambooToken Malware Hijacks Legitimate Software to Establish Covert C2 via MQTT","2026-09-15T16:21:24.994+00:00",{"slug":43,"title":44,"published_at":45},"signed-adware-used-as-trojan-horse-to-deliver-valleyrat-backdoor","Signed Adware Used as Trojan Horse to Deliver ValleyRAT Backdoor","2026-08-31T14:21:35.438+00:00",{"slug":47,"title":48,"published_at":49},"valleyrat-backdoor-hidden-inside-fake-adware-installer","ValleyRAT Backdoor Hidden Inside Fake Adware Installer","2026-08-31T12:21:08.906+00:00",{"slug":51,"title":52,"published_at":53},"terminalfix-campaign-exploits-user-trust-to-deploy-persistent-reverse-tunnels","TerminalFix Campaign Exploits User Trust to Deploy Persistent Reverse Tunnels","2026-08-29T06:20:25.828+00:00",{"slug":55,"title":56,"published_at":57},"sleepwalker-backdoor-hides-in-legitimate-software-via-dll-side-loading","SLEEPWALKER Backdoor Hides in Legitimate Software via DLL Side-Loading","2026-08-26T10:22:30.654+00:00",{"slug":59,"title":60,"published_at":61},"byovd-attack-chain-deploys-valleyrat-on-japanese-manufacturer","BYOVD Attack Chain Deploys ValleyRAT on Japanese Manufacturer","2026-07-30T12:21:31.372+00:00",{"slug":63,"title":64,"published_at":65},"fake-notepad-plugin-used-to-deploy-espionage-malware-in-phishing-campaign","Fake Notepad++ Plugin Used to Deploy Espionage Malware in Phishing Campaign","2026-07-24T08:20:39.734+00:00",[67,72,77,82,87,91],{"slug":68,"name":69,"problem":70,"stories":71},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",23,{"slug":73,"name":74,"problem":75,"stories":76},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",12,{"slug":78,"name":79,"problem":80,"stories":81},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",9,{"slug":83,"name":84,"problem":85,"stories":86},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",6,{"slug":88,"name":89,"problem":90,"stories":86},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":92,"name":93,"problem":94,"stories":95},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",4,[97,103,109,114,120,124,129,133],{"family":98,"item":99,"code":100,"title":101,"together":102},"nist-800-53","si-3","SI-3","Malicious Code Protection",19,{"family":104,"item":105,"code":106,"title":107,"together":108},"cis","2","Control 2","Inventory and Control of Software Assets",18,{"family":104,"item":110,"code":111,"title":112,"together":113},"13","Control 13","Network Monitoring and Defense",15,{"family":115,"item":116,"code":117,"title":118,"together":119},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",13,{"family":104,"item":121,"code":122,"title":123,"together":76},"10","Control 10","Malware Defenses",{"family":104,"item":125,"code":126,"title":127,"together":128},"9","Control 9","Email and Web Browser Protections",8,{"family":98,"item":130,"code":131,"title":132,"together":128},"ac-6","AC-6","Least Privilege",{"family":98,"item":134,"code":135,"title":136,"together":128},"cm-7","CM-7","Least Functionality"]