Hijack Execution Flow: DLL Search Order Hijacking

APT41 has used search order hijacking to execute malicious payloads, such as Winnti for Windows.^[11]

APT41 DUST involved the use of DLL search order hijacking to execute DUSTTRAP.^[12]

Aquatic Panda has used DLL search-order hijacking to load exe, dll, and dat files into memory.^[13] Aquatic Panda loaded a malicious DLL into the legitimate Windows Security Health Service executable (SecurityHealthService.exe) to execute malicious code on victim systems.^[14]

Astaroth can launch itself via DLL Search Order Hijacking.^[15]

BackdoorDiplomacy has executed DLL search order hijacking.^[16]

BOOSTWRITE has exploited the loading of the legitimate Dwrite.dll file by actually loading the gdi library, which then loads the gdiplus library and ultimately loads the local Dwrite dll.^[17]

Brute Ratel C4 has used search order hijacking to load a malicious payload DLL as a dependency to a benign application packaged in the same ISO.^[18]

Chaes has used search order hijacking to load a malicious DLL.^[19]

Cinnamon Tempest has used search order hijacking to launch Cobalt Strike Beacons.^[20][21]

Crutch can persist via DLL search order hijacking on Google Chrome, Mozilla Firefox, or Microsoft OneDrive.^[22]

Downdelph uses search order hijacking of the Windows executable sysprep.exe to escalate privileges.^[23]

Empire contains modules that can discover and exploit various DLL hijacking opportunities.^[24]

Evilnum has used the malware variant, TerraTV, to load a malicious DLL placed in the TeamViewer directory, instead of the original Windows DLL located in a system folder.^[25]

A FinFisher variant uses DLL search order hijacking.^[26][27]

FoggyWeb's loader has used DLL Search Order Hijacking to load malicious code instead of the legitimate version.dll during the Microsoft.IdentityServer.ServiceHost.exe execution process.^[28]

Hikit has used DLL Search Order Hijacking to load oci.dll as a persistence mechanism.^[29]

HTTPBrowser abuses the Windows DLL load order by using a legitimate Symantec anti-virus binary, VPDN_LU.exe, to load a malicious DLL that mimics a legitimate Symantec DLL, navlu.dll.^[30]

HUI Loader can be deployed to targeted systems via legitimate programs that are vulnerable to DLL search order hijacking.^[21]

InvisiMole can be launched by using DLL search order hijacking in which the wrapper DLL is placed in the same folder as explorer.exe and loaded during startup into the Windows Explorer process instead of the legitimate library.^[31]

Melcoz can use DLL hijacking to bypass security controls.^[15]

menuPass has used DLL search order hijacking.^[32]

MirageFox is likely loaded via DLL hijacking into a legitimate McAfee binary.^[33]

PlugX has the ability to use DLL search order hijacking for installation on targeted systems.^[34]

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes.^[35][36]

Prikormka uses DLL search order hijacking for persistence by saving itself as ntshrui.dll to the Windows directory so it will load before the legitimate ntshrui.dll saved in the System32 subdirectory.^[37]

Ramsay can hijack outdated Windows application dependencies with malicious versions of its own DLL payload.^[38]

RedLeaves is launched through use of DLL search order hijacking to load a malicious dll.^[39]

RTM has used search order hijacking to force TeamViewer to load a malicious DLL.^[40]

Threat Group-3390 has performed DLL search order hijacking to execute their payload.^[41]

Tonto Team abuses a legitimate and signed Microsoft executable to launch a malicious DLL.^[42]

WastedLocker has performed DLL hijacking before execution.^[43]

Variants of WEBC2 achieve persistence by using DLL search order hijacking, usually by copying the DLL file to %SYSTEMROOT% (C:\WINDOWS\ntshrui.dll).^[44]

Whitefly has used search order hijacking to run the loader Vcrodat.^[45]

Use auditing tools capable of detecting DLL search order hijacking opportunities on systems within an enterprise and correct them. Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for DLL hijacking weaknesses.^[46]

Use the program sxstrace.exe that is included with Windows along with manual inspection to check manifest files for side-by-side problems in software.^[47]

Adversaries may use new DLLs to execute this technique. Identify and block potentially malicious software executed through search order hijacking by using application control solutions capable of blocking DLLs loaded by legitimate software.

Disallow loading of remote DLLs. This is included by default in Windows Server 2012+ and is available by patch for XP+ and Server 2003+.

Enable Safe DLL Search Mode to force search for system DLLs in directories with greater restrictions (e.g. %SYSTEMROOT%)to be used before local directory DLLs (e.g. a user's home directory)

The Safe DLL Search Mode can be enabled via Group Policy at Computer Configuration > [Policies] > Administrative Templates > MSS (Legacy): MSS: (SafeDllSearchMode) Enable Safe DLL search mode. The associated Windows Registry key for this is located at HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDLLSearchMode^[48][1]