Technique
№ 016 · class: execution
DLL Sideloading
Technique of loading a malicious DLL through a legitimate program that requests it.
Term
description · examples · notesTechnique of loading a malicious DLL through a legitimate program that requests it.
Description
Exploits the DLL search order in the Windows operating system.
The malicious DLL is placed in the same folder as the legitimate executable.
The signed legitimate program loads the malicious DLL without verification.
Used by APT groups to bypass application whitelisting controls.
Examples
- APT41 using DLL sideloading with signed VMware tools
- PlugX malware delivered via DLL sideloading
Notes
- Windows-specific; requires knowledge of the target application.
Mentioned in the news
Threats
used by 4Threats that use it. Select one to open its page.
Defenses
countered by 5How it is countered. Select one to open its page.