DLL Search Order Hijacking and Side-Loading

What It Is

What Changes Inside the Process

The process is shown before and after, and the pointer marks what changed.

What It Leaves Behind

Which Evidence Can See It

Each tile says whether that kind of evidence can see it, and what it shows.

• Memory

  Sees it

  windows.dlllist shows each module's path while its process runs, so a Windows name from the wrong folder stands out.

• EDR Telemetry

  Sees it

  Defender XDR's image load table records each load with its folder, its SHA1 and the process that loaded it. Its certificate table gives the signer.

• Disk

  Partly

  The DLL sits in the folder it loaded from unless it was removed, with its signer and version information to compare with the genuine file.

• Logs

  Partly

  Sysmon event 7 in the Sysmon Operational log records each load with its path, hashes and signature. It is off by default and logs only what its configuration keeps.

How to Confirm It

Work through these in order. Each step names the page that shows how.

1. List the process's modules with their folders (ListDLLs, Process Explorer, windows.dlllist). A Windows DLL name outside System32, SysWOW64 or WinSxS stands out.Loaded DLLs
2. Check the DLL's signature against its name. The pattern is a DLL that is unsigned, or signed by someone other than Microsoft for a Windows name, beside a program in a user-writable folder.Loaded DLLs
3. Find what starts the trusted program from that folder. A task, a service or a Run key that points at a copy outside its install folder brings the DLL back at every start.Process Trees and Call Chains
4. Look for proxy DLLs that forward their exports to a DLL of the same name. Velociraptor's Windows.Detection.ForwardedImports lists them once its file glob covers the program's folder, as by default it reads only C:\Windows.Loaded DLLs
5. Collect the DLL and the program, or extract them from a memory image with windows.dumpfiles, and analyse them away from the machine.Dumping a Process and Memory

Investigation Steps With Named Tools

Each question has the tools that answer it on a running machine, and in a memory image, a copy of its memory saved to a file.

• Where did each module load from, and who signed it?

  On a Running Machine

  • DeviceImageLoadEvents (documentation, opens in a new tab)Logs and Records A Defender XDR table. It holds the records Defender for Endpoint keeps of what happened on each machine, and you search it with KQL. Each load's FileName, FolderPath and SHA1 with the process that loaded it. Join DeviceFileCertificateInfo on SHA1 for the signer.
  • Windows.System.DLLs (documentation, opens in a new tab)Live Machine A Velociraptor artifact. It is a ready-made question Velociraptor asks of running machines, named from general to specific. A built-in artifact listing the DLLs of running processes with their paths, and signer details when CertificateInfo is on.

  In a Memory Image

  • windows.dlllist (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. dlllist means DLL list. Each module's path from the process's loader list, so a Windows name outside the system folders stands out.
  • windows.malware.ldrmodules (documentation, opens in a new tab)Memory Image A Volatility 3 plugin from its malware group. It checks a memory image for code that hides, or code put into a process. ldrmodules means loader modules. Each region that starts with an MZ header, with the file the kernel recorded for it, to set beside the loader list.

• Is the DLL the genuine file of that name?

  On a Running Machine

  • Windows.Detection.ForwardedImports (documentation, opens in a new tab)Live Machine A Velociraptor artifact. It is a ready-made question Velociraptor asks of running machines, named from general to specific. A built-in artifact that finds DLLs forwarding to a DLL of the same name, a proxy's mark. Its default glob reads only C:\Windows.
  • Defender for Endpoint live response (documentation, opens in a new tab)Live Machine Part of Defender for Endpoint. It opens a command console on one machine from the Defender portal, so you can list its processes from your desk. processes Its processes command shows whether the program runs, findfile and fileinfo locate and describe each copy of a DLL name, and getfile collects one. No command lists modules.

  In a Memory Image

  • windows.verinfo (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. The version information of each loaded DLL, to compare with the genuine file of that name.

What Defenders See

Each record names its log and what must be switched on to get it.

False Positives

Some vendors ship their own copies of common DLLs beside their programs, and portable apps load DLLs from their own folders by design. Check the signer, and whether the vendor ships that file.

Installers and updaters stage signed programs and their DLLs in temporary folders and run them there.

Blind Spots

Sysmon event 7 is off by default and heavy when on, so a configuration that filters loads can drop the one that matters. Check yours before you trust a miss.

A DLL signed with a stolen or bought certificate passes a signature check, so judge the folder and the signer's name together.

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

// DLLs named like a System32 DLL, loaded from outside the system folders and not validly signed by Microsoftlet SystemDllNames = DeviceImageLoadEvents    | where Timestamp > ago(7d)    | where FolderPath startswith @"C:\Windows\System32\"    | distinct FileName;DeviceImageLoadEvents| where Timestamp > ago(30d)| where FileName in~ (SystemDllNames)| where not(FolderPath startswith @"C:\Windows\System32\" or FolderPath startswith @"C:\Windows\SysWOW64\" or FolderPath startswith @"C:\Windows\WinSxS\")| join kind=leftouter (DeviceFileCertificateInfo | summarize arg_max(Timestamp, IsSigned, IsTrusted, Signer) by SHA1) on SHA1| where isnull(IsSigned) or not(IsSigned) or not(IsTrusted) or not(Signer startswith "Microsoft")| summarize Loads = count(), Devices = dcount(DeviceId), FirstSeen = min(Timestamp)    by FileName, FolderPath, Signer, IsTrusted, InitiatingProcessFileName, InitiatingProcessFolderPath| order by Devices asc, Loads asc

In a Memory Image

Volatility 3 reads a memory image, and each of its plugins below shows part of this sign.

• windows.dlllist (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. dlllist means DLL list. Each module's path as the loader recorded it, so a Windows DLL name from the program's own folder stands out. Its dump option extracts it.
• windows.malware.ldrmodules (documentation, opens in a new tab)Memory Image A Volatility 3 plugin from its malware group. It checks a memory image for code that hides, or code put into a process. ldrmodules means loader modules. Every region that starts with an MZ header, with the file the kernel records for it, and whether each of the loader's three lists names it.
• windows.verinfo (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. The version numbers of each DLL in the loader's list, to compare with the genuine file of that name.
• windows.dumpfiles (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. The DLL and the program as cached in memory, extracted for analysis away from the machine.

Rules to Compare With

Security vendors publish detection rules anyone can read. These look for the same thing, so compare your own with them.

How to Prevent It

Each control helps prevent it, and its line says what it does here.

• KnownDLLs (opens in a new tab) Keep KnownDLLs as Windows sets it, so the core DLLs on it always load from the system's own copy. Check it in the Registry: KnownDLLs
• App Control for Business (opens in a new tab) Let only code a policy trusts load, so an unsigned DLL is refused wherever it lands.
• ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion (opens in a new tab) Block executable files that are new, rare or untrusted, which Microsoft says covers DLLs as well as programs.
• Secure Boot, which turns AppInit_DLLs off (opens in a new tab) Keep Secure Boot on, so AppInit_DLLs, another way to put a DLL into processes, stays off. Check it in the Registry: AppInit_DLLs

Related

Where It Matters Most

• explorer.exe A Windows DLL name loaded into it from outside System32, SysWOW64 or WinSxS, or without Microsoft's signature.

Travels with

• Unsigned or Oddly Signed Modules A side-loaded DLL is often unsigned or signed by someone its name does not suggest, the sign that page covers.
• Wrong Path The trusted program itself often runs from a copy outside its install folder.

Check It in the Registry

KnownDLLsAppInit_DLLsAppCertDllsApp PathsCOM Hijacking (User CLSID)

Sources

• Microsoft Learn: Dynamic-link library search order (opens in a new tab)
• Microsoft Learn: Dynamic-Link Library Security (opens in a new tab)
• Microsoft Learn: Sysmon, event ID 7 Image loaded (opens in a new tab)
• Microsoft Defender XDR: DeviceImageLoadEvents table (opens in a new tab)
• Microsoft Defender XDR: DeviceFileCertificateInfo table (opens in a new tab)
• Microsoft Learn: Live response in Defender for Endpoint (opens in a new tab)
• HijackLibs (opens in a new tab)
• Velociraptor: Windows.Detection.ForwardedImports (opens in a new tab)
• SigmaHQ: Potential System DLL Sideloading From Non System Locations (opens in a new tab)
• Elastic: Unsigned DLL Side-Loading from a Suspicious Folder (opens in a new tab)