Procedure examples

Pandora can use DLL side-loading to execute malicious payloads.

FinFisher uses DLL side-loading to load malicious programs. A FinFisher variant also uses DLL search order hijacking.

Wingbird side loads a malicious file, sspisrv.dll, in part of a spoofed lssas.exe service.

Ramsay can hijack outdated Windows application dependencies with malicious versions of its own DLL payload.

AshTag has enabled execution via DLL sideloading using a legitimate executable paired with a malicious DLL named wtsapi32.

SysUpdate can load DLLs through vulnerable legitimate executables.

PowGoop can side-load `Goopdate.dll` into `GoogleUpdate.exe`.

ANELLDR can use DLL sideloading from a legitimate application to initiate execution.

LookBack side loads its communications module as a DLL into the libcurl.dll loader.

Egregor has used DLL side-loading to execute its payload.

Melcoz can use DLL hijacking to bypass security controls.

HIUPAN has abused legitimate executables to side-load malicious DLLs to include the legitimate exe UsbConfig.exe.

metaMain can support an HKCMD sideloading start method.

HTTPBrowser abuses the Windows DLL load order by using a legitimate Symantec anti-virus binary, VPDN_LU.exe, to load a malicious DLL that mimics a legitimate Symantec DLL, navlu.dll. HTTPBrowser has also used DLL side-loading.

MirageFox is likely loaded via DLL hijacking into a legitimate McAfee binary.

Pcexter has been distributed and executed as a DLL file named Vspmsg.dll via DLL side-loading.

StarProxy has been side-loaded by the legitimate, signed executable, IsoBurner.exe.

BADNEWS typically loads its DLL file into a legitimate signed Java or VMware executable.

Goopy has the ability to side-load malicious DLLs with legitimate applications from Kaspersky, Microsoft, and Google.

Astaroth can launch itself via DLL Search Order Hijacking.

QakBot has the ability to use DLL side-loading for execution.

Dridex can abuse legitimate Windows executables to side-load malicious DLL files.

Denis exploits a security vulnerability to load a fake DLL and execute its code.

Waterbear has used DLL side loading to import and load a malicious DLL loader.

UPPERCUT has been sideloaded through a legitimately signed application from the JustSystems Corporation.

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes.

Empire contains modules that can discover and exploit various DLL hijacking opportunities.

Brute Ratel C4 has used search order hijacking to load a malicious payload DLL as a dependency to a benign application packaged in the same ISO. Brute Ratel C4 has loaded a malicious DLL by spoofing the name of the legitimate Version.DLL and placing it in the same folder as the digitally-signed Microsoft binary OneDriveUpdater.exe.

Empire has a dylib hijacker module that generates a malicious dylib given the path to a legitimate dylib of a vulnerable application.

Mustang Panda has leveraged legitimate software installer executables such as Setup Factory “IRSetup.exe” to drop and execute their payload.

APT41 has configured payloads to load via LD_PRELOAD.

Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.

Aquatic Panda modified the ld.so preload file in Linux environments to enable persistence for Winnti malware.

MEDUSA can execute code through dynamic linker hijacking of the `LD_PRELOAD` library.

COATHANGER copies the malicious file /data2/.bd.key/preload.so to /lib/preload.so, then launches a child process that executes the malicious file /data2/.bd.key/authd as /bin/authd with the arguments /lib/preload.so reboot newreboot 1. This injects the malicious preload.so file into the process with PID 1, and replaces its reboot function with the malicious newreboot function for persistence.

Hildegard has modified /etc/ld.so.preload to intercept shared library import functions.

SPAWNCHIMERA has been compiled as a Position Independent Executable (PIE) to use a third-party library for injection.

When Ebury is running as an OpenSSH server, it uses LD_PRELOAD to inject its malicious shared module in to programs launched by SSH sessions. Ebury hooks the following functions from `libc` to inject into subprocesses; `system`, `popen`, `execve`, `execvpe`, `execv`, `execvp`, and `execl`.

XCSSET adds malicious file paths to the DYLD_FRAMEWORK_PATH and DYLD_LIBRARY_PATH environment variables to execute malicious code.

HiddenWasp adds itself as a shared object to the LD_PRELOAD environment variable.

BRICKSTORM has checked hard-coded paths of `/etc/sysconfig/` or `/etc/sysconfig/network` prior to execution and loading file contents from that path.

DarkGate overrides the %windir% environment variable by setting a Registry key, HKEY_CURRENT_User\Environment\windir, to an alternate command to execute a malicious AutoIt script. This allows DarkGate to run every time the scheduled task DiskCleanup is executed as this uses the path value %windir%\system32\cleanmgr.exe for execution.

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit path interception opportunities in the PATH environment variable.

Empire contains modules that can discover and exploit path interception opportunities in the PATH environment variable.

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit search order hijacking vulnerabilities.

Empire contains modules that can discover and exploit search order hijacking vulnerabilities.

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit unquoted path vulnerabilities.

Empire contains modules that can discover and exploit unquoted path vulnerabilities.

One variant of BlackEnergy locates existing driver services that have been disabled and drops its driver component into one of those service's paths, replacing the legitimate executable. The malware then sets the hijacked service to start automatically to establish persistence.

During Operation Honeybee, the threat actors used a batch file that modified the COMSysApp service to load a malicious ipnet.dll payload and to load a DLL into the `svchost.exe` process.