Procedure examples

Ramsay can hijack outdated Windows application dependencies with malicious versions of its own DLL payload.

AshTag has enabled execution via DLL sideloading using a legitimate executable paired with a malicious DLL named wtsapi32.

SysUpdate can load DLLs through vulnerable legitimate executables.

PowGoop can side-load `Goopdate.dll` into `GoogleUpdate.exe`.

ANELLDR can use DLL sideloading from a legitimate application to initiate execution.

LookBack side loads its communications module as a DLL into the libcurl.dll loader.

Egregor has used DLL side-loading to execute its payload.

Melcoz can use DLL hijacking to bypass security controls.

HIUPAN has abused legitimate executables to side-load malicious DLLs to include the legitimate exe UsbConfig.exe.

metaMain can support an HKCMD sideloading start method.

HTTPBrowser abuses the Windows DLL load order by using a legitimate Symantec anti-virus binary, VPDN_LU.exe, to load a malicious DLL that mimics a legitimate Symantec DLL, navlu.dll. HTTPBrowser has also used DLL side-loading.

MirageFox is likely loaded via DLL hijacking into a legitimate McAfee binary.

Pcexter has been distributed and executed as a DLL file named Vspmsg.dll via DLL side-loading.

StarProxy has been side-loaded by the legitimate, signed executable, IsoBurner.exe.

BADNEWS typically loads its DLL file into a legitimate signed Java or VMware executable.

Goopy has the ability to side-load malicious DLLs with legitimate applications from Kaspersky, Microsoft, and Google.

Astaroth can launch itself via DLL Search Order Hijacking.

QakBot has the ability to use DLL side-loading for execution.

Dridex can abuse legitimate Windows executables to side-load malicious DLL files.

Denis exploits a security vulnerability to load a fake DLL and execute its code.

Waterbear has used DLL side loading to import and load a malicious DLL loader.

UPPERCUT has been sideloaded through a legitimately signed application from the JustSystems Corporation.

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes.

Empire contains modules that can discover and exploit various DLL hijacking opportunities.

Brute Ratel C4 has used search order hijacking to load a malicious payload DLL as a dependency to a benign application packaged in the same ISO. Brute Ratel C4 has loaded a malicious DLL by spoofing the name of the legitimate Version.DLL and placing it in the same folder as the digitally-signed Microsoft binary OneDriveUpdater.exe.