Procedure examples

HIUPAN has abused legitimate executables to side-load malicious DLLs to include the legitimate exe UsbConfig.exe.

metaMain can support an HKCMD sideloading start method.

HTTPBrowser abuses the Windows DLL load order by using a legitimate Symantec anti-virus binary, VPDN_LU.exe, to load a malicious DLL that mimics a legitimate Symantec DLL, navlu.dll. HTTPBrowser has also used DLL side-loading.

MirageFox is likely loaded via DLL hijacking into a legitimate McAfee binary.

Pcexter has been distributed and executed as a DLL file named Vspmsg.dll via DLL side-loading.

StarProxy has been side-loaded by the legitimate, signed executable, IsoBurner.exe.

BADNEWS typically loads its DLL file into a legitimate signed Java or VMware executable.

Goopy has the ability to side-load malicious DLLs with legitimate applications from Kaspersky, Microsoft, and Google.

Astaroth can launch itself via DLL Search Order Hijacking.

QakBot has the ability to use DLL side-loading for execution.

Dridex can abuse legitimate Windows executables to side-load malicious DLL files.

Denis exploits a security vulnerability to load a fake DLL and execute its code.

Waterbear has used DLL side loading to import and load a malicious DLL loader.

UPPERCUT has been sideloaded through a legitimately signed application from the JustSystems Corporation.

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes.

Empire contains modules that can discover and exploit various DLL hijacking opportunities.

Brute Ratel C4 has used search order hijacking to load a malicious payload DLL as a dependency to a benign application packaged in the same ISO. Brute Ratel C4 has loaded a malicious DLL by spoofing the name of the legitimate Version.DLL and placing it in the same folder as the digitally-signed Microsoft binary OneDriveUpdater.exe.

Empire has a dylib hijacker module that generates a malicious dylib given the path to a legitimate dylib of a vulnerable application.

MEDUSA can execute code through dynamic linker hijacking of the `LD_PRELOAD` library.

COATHANGER copies the malicious file /data2/.bd.key/preload.so to /lib/preload.so, then launches a child process that executes the malicious file /data2/.bd.key/authd as /bin/authd with the arguments /lib/preload.so reboot newreboot 1. This injects the malicious preload.so file into the process with PID 1, and replaces its reboot function with the malicious newreboot function for persistence.

Hildegard has modified /etc/ld.so.preload to intercept shared library import functions.

SPAWNCHIMERA has been compiled as a Position Independent Executable (PIE) to use a third-party library for injection.

When Ebury is running as an OpenSSH server, it uses LD_PRELOAD to inject its malicious shared module in to programs launched by SSH sessions. Ebury hooks the following functions from `libc` to inject into subprocesses; `system`, `popen`, `execve`, `execvpe`, `execv`, `execvp`, and `execl`.

XCSSET adds malicious file paths to the DYLD_FRAMEWORK_PATH and DYLD_LIBRARY_PATH environment variables to execute malicious code.

HiddenWasp adds itself as a shared object to the LD_PRELOAD environment variable.

BRICKSTORM has checked hard-coded paths of `/etc/sysconfig/` or `/etc/sysconfig/network` prior to execution and loading file contents from that path.

DarkGate overrides the %windir% environment variable by setting a Registry key, HKEY_CURRENT_User\Environment\windir, to an alternate command to execute a malicious AutoIt script. This allows DarkGate to run every time the scheduled task DiskCleanup is executed as this uses the path value %windir%\system32\cleanmgr.exe for execution.

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit path interception opportunities in the PATH environment variable.

Empire contains modules that can discover and exploit path interception opportunities in the PATH environment variable.

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit search order hijacking vulnerabilities.

Empire contains modules that can discover and exploit search order hijacking vulnerabilities.

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit unquoted path vulnerabilities.

Empire contains modules that can discover and exploit unquoted path vulnerabilities.

One variant of BlackEnergy locates existing driver services that have been disabled and drops its driver component into one of those service's paths, replacing the legitimate executable. The malware then sets the hijacked service to start automatically to establish persistence.

DarkTortilla can detect profilers by verifying the `COR_ENABLE_PROFILING` environment variable is present and active.

FinFisher has used the KernelCallbackTable to hijack the execution flow of a process by replacing the __fnDWORD function with the address of a created Asynchronous Procedure Call stub routine.

IMAPLoader is executed via the AppDomainManager injection technique.

Pacu can create snapshots of EBS volumes and RDS instances.

Pacu can enumerate AWS infrastructure, such as EC2 instances.

TruffleHog can enumerate AWS Infrastructure to include EC2 instances.

TeamPCP Cloud Stealer has the ability to search for generic GitHub runners.

Raspberry Robin uses newly-registered domains containing only a few characters for command and controll purposes, such as "v0[.]cx".

DarkGate command and control includes hard-coded domains in the malware chosen to masquerade as legitimate services such as Akamai CDN or Amazon Web Services.

XLoader can utilize hardcoded command and control domain configurations created by the XLoader authors. These are designed to mimic domain registrars and hosting service providers such as Hostinger and Namecheap.

Raspberry Robin variants have been delivered via malicious advertising items that, when interacted with, download a malicious archive file containing the initial payload, hosted on services such as Discord.

Gootloader has used compromised legitimate domains to as a delivery network for malicious payloads.

Gootloader can insert malicious scripts to compromise vulnerable content management systems (CMS).

FIN7 has obtained and used tools such as Impacket, Mimikatz, and PsExec.

MegaCortex has used code signing certificates issued to fake companies to bypass security controls.

LazyWiper is believed to have been generated by a large language model (LLM) due to the non-sensical comments in the code.