DLL Search Order Hijacking

Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft Dynamic Link Library Search Order)(Citation: FireEye Hijacking July 2010) Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.

There are many ways an adversary can hijack DLL loads. Adversaries may plant trojan dynamic-link library files (DLLs) in a directory that will be searched before the location of a legitimate library that will be requested by a program, causing Windows to load their malicious library when it is called for by the victim program. Adversaries may also perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program.(Citation: FireEye fxsst June 2011) Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. (Citation: Microsoft Security Advisory 2269637)

Phantom DLL hijacking is a specific type of DLL search order hijacking where adversaries target references to non-existent DLL files.(Citation: Adversaries Hijack DLLs) They may be able to load their own malicious DLL by planting it with the correct name in the location of the missing module.

Adversaries may also directly modify the search order via DLL redirection, which after being enabled (in the Registry and creation of a redirection file) may cause a program to load a different DLL.(Citation: Microsoft Dynamic-Link Library Redirection)(Citation: Microsoft Manifests)(Citation: FireEye DLL Search Order Hijacking)

If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program. Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace.

Platforms: Windows
Tactics:
phase_name: persistence
phase_name: privilege-escalation
phase_name: defense-evasion

Detection:
Monitor file systems for moving, renaming, replacing, or modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared with past behavior) that do not correlate with known software, patches, etc., are suspicious. Monitor DLLs loaded into a process and detect DLLs that have the same file name but abnormal paths. Modifications to or creation of `.manifest` and `.local` redirection files that do not correlate with software updates are suspicious.

References:
source_name: mitre-attack
description: CrowdStrike, Falcon OverWatch Team. (2022, December 30). Retrieved October 19, 2023.
source_name: Adversaries Hijack DLLs
description: Harbour, N. (2010, July 15). Malware Persistence without the Windows Registry. Retrieved November 17, 2020.
source_name: FireEye Hijacking July 2010
description: Harbour, N. (2011, June 3). What the fxsst?. Retrieved November 17, 2020.
source_name: FireEye fxsst June 2011
description: Microsoft. (, May 23). Microsoft Security Advisory 2269637. Retrieved March 13, 2020.
source_name: Microsoft Security Advisory 2269637
description: Microsoft. (2018, May 31). Dynamic-Link Library Redirection. Retrieved March 13, 2020.
source_name: Microsoft Dynamic-Link Library Redirection
description: Microsoft. (2018, May 31). Dynamic-Link Library Search Order. Retrieved November 30, 2014.
source_name: Microsoft Dynamic Link Library Search Order
description: Microsoft. (n.d.). Manifests. Retrieved December 5, 2014.
source_name: Microsoft Manifests
description: Nick Harbour. (2010, September 1). DLL Search Order Hijacking Revisited. Retrieved March 13, 2020.
source_name: FireEye DLL Search Order Hijacking
description: OWASP. (2013, January 30). Binary planting. Retrieved June 7, 2016.
source_name: OWASP Binary Planting