Applied Cybernetics Group
T1574.001 DLL
- Technique
T1574.001- Tactics
- Defense Evasion, Execution
- Research, 90 days
- 6
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 93
- Elastic, Splunk
- 30
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1574/001
MITRE description
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.(Citation: unit 42) Specific ways DLLs are abused by adversaries include: ### DLL Sideloading Adversaries may execute their own malicious payloads by side-loading DLLs. Side-loading involves hijacking which DLL a program loads by planting and then invoking a legitimate application that executes their payload(s). Side-loading positions both the victim application and malicious payload(s) alongside each other. Adversaries likely use side-loading as a means of masking actions they perform under a legitimate, trusted, and potentially elevated system or software process. Benign executables used to side-load payloads may not be flagged during delivery and/or execution. Adversary payloads may also be encrypted/packed or otherwise obfuscated until loaded into the memory of the trusted process. Adversaries may also side-load other packages, such as BPLs (Borland Package Library).(Citation: kroll bpl) Adversaries may chain DLL sideloading multiple times to fragment functionality hindering analysis. Adversaries using multiple DLL files can split the loader functions across different DLLs, with a main DLL loading the separated export functions.(Citation: Virus Bulletin) Spreading loader functions across multiple DLLs makes analysis harder, since all files must be collected to fully understand the malware’s behavior. Another method implements a “loader-for-a-loader”, where a malicious DLL’s sole role is to load a second DLL (or a chain of DLLs) that contain the real payload.(Citation: Sophos) ### DLL Search Order Hijacking Adversaries may execute their own malicious payloads by hijacking the search order that Windows uses to load DLLs. This search order is a sequence of special and standard search locations that a program checks when loading a DLL. An adversary can plant a trojan DLL in a directory that will be prioritized by the DLL search order over the location of a legitimate library. This will cause Windows to load the malicious DLL when it is called for by the victim program.(Citation: unit 42) ### DLL Redirection Adversaries may directly modify the search order via DLL redirection, which after being enabled (in the Registry or via the creation of a redirection file) may cause a program to load a DLL from a different location.(Citation: Microsoft redirection)(Citation: Microsoft - manifests/assembly) ### Phantom DLL Hijacking Adversaries may leverage phantom DLL hijacking by targeting references to non-existent DLL files. They may be able to load their own malicious DLL by planting it with the correct name in the location of the missing module.(Citation: Hexacorn DLL Hijacking)(Citation: Hijack DLLs CrowdStrike) ### DLL Substitution Adversaries may target existing, valid DLL files and substitute them with their own malicious DLLs, planting them with the same name and in the same location as the valid DLL file.(Citation: Wietze Beukema DLL Hijacking) Programs that fall victim to DLL hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace, evading defenses. Remote DLL hijacking can occur when a program sets its current directory to a remote location, such as a Web share, before loading a DLL.(Citation: dll pre load owasp)(Citation: microsoft remote preloading) If a valid DLL is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-11-04ESET: SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware -
2026-10-30Darktrace: CikaBika Bot: Inside a Discord RAT Campaign -
2026-10-15Google Threat Intelligence: Investigating Ephemeral Supply Chain Tampering -
2026-09-17ESET: Beware the SparroWock: The backdoor that bites, the commands that catch -
2026-08-28Elastic Security Labs: From 88 lines to 1: Detecting DLL hijacking with Elastic Defend -
2026-08-13Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them
Detection coverage
SigmaHQ community rules
- Potential PlugX Activity (emerging-threats)
- APT27 - Emissary Panda Activity (emerging-threats)
- Winnti Malware HK University Campaign (emerging-threats)
- Winnti Pipemon Characteristics (emerging-threats)
- Pingback Backdoor File Indicators (emerging-threats)
- Pingback Backdoor DLL Loading Activity (emerging-threats)
- Pingback Backdoor Activity (emerging-threats)
- Small Sieve Malware CommandLine Indicator (emerging-threats)
- DLL Names Used By SVR For GraphicalProton Backdoor (emerging-threats)
- Diamond Sleet APT DLL Sideloading Indicators (emerging-threats)
- Lazarus APT DLL Sideloading Activity (emerging-threats)
- Potential Raspberry Robin Aclui Dll SideLoading (emerging-threats)
- Signed DLL Loaded With Missing PE Version Metadata (threat-hunting)
- Use Of Hidden Paths Or Files (core)
- DNS Server Error Failed Loading the ServerLevelPluginDLL (core)
- Microsoft Defender Blocked from Loading Unsigned DLL (core)
- Unsigned Binary Loaded From Suspicious Location (core)
- DHCP Server Error Failed Loading the CallOut DLL (core)
- DHCP Server Loaded the CallOut DLL (core)
- Creation Of Non-Existent System DLL (core)
- DLL Search Order Hijackig Via Additional Space in Path (core)
- HackTool - Powerup Write Hijack DLL (core)
- Potential Initial Access via DLL Search Order Hijacking (core)
- Malicious DLL File Dropped in the Teams or OneDrive Folder (core)
- Creation of WerFault.exe/Wer.dll in Unusual Folder (core)
Showing 25 of 93 community rules.
the full set is tagged attack.t1574.001 in
SigmaHQ.
Elastic and Splunk rules
- Untrusted DLL Loaded by Azure AD Connect Authentication Agent (elastic)
- Suspicious Antimalware Scan Interface DLL (elastic)
- Potential DLL Side-Loading via Trusted Microsoft Programs (elastic)
- Suspicious Microsoft Antimalware Service Execution (elastic)
- Potential Masquerading as System32 DLL (elastic)
- Potential Windows Session Hijacking via CcmExec (elastic)
- Unsigned DLL Side-Loading from a Suspicious Folder (elastic)
- WPS Office Exploitation via DLL Hijack (elastic)
- Execution via local SxS Shared Module (elastic)
- Suspicious DLL Loaded for Persistence or Privilege Escalation (elastic)
- UAC Bypass Attempt via Privileged IFileOperation COM Interface (elastic)
- Unsigned DLL Loaded by a Trusted Process (elastic)
- MSI Module Loaded by Non-System Binary (splunk)
- Msmpeng Application DLL Side Loading (splunk)
- Windows DLL Search Order Hijacking Hunt with Sysmon (splunk)
- Windows DLL Search Order Hijacking with iscsicpl (splunk)
- Windows DLL Side-Loading In Calc (splunk)
- Windows DLL Side-Loading Process Child Of Calc (splunk)
- Windows Hijack Execution Flow Version Dll Side Load (splunk)
- Windows Known Abused DLL Created (splunk)
- Windows Known Abused DLL Loaded Suspiciously (splunk)
- Windows Known GraphicalProton Loaded Modules (splunk)
- Windows Masquerading Explorer As Child Process (splunk)
- Windows Mustang Panda USB Tool Execution (splunk)
- Windows Phantom DLL Created on Disk (splunk)
Showing 25 of 30.