DLL
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.(Citation: unit 42) Specific ways DLLs are abused by adversaries include: ### DLL Sideloading Adversaries may exec...
BY SOURCE
PROCEDURES (41)
Auto-extracted: 39 detections for dll side
Auto-extracted: 6 detections for module load monitoring
Auto-extracted: 5 detections for process creation monitoring
Auto-extracted: 4 detections for privilege
Auto-extracted: 4 detections for general monitoring
Auto-extracted: 3 detections for registry
Auto-extracted: 2 detections for azure
Auto-extracted: 2 detections for bypass
Auto-extracted: 2 detections for dns
Auto-extracted: 2 detections for parent process
Auto-extracted: 2 detections for dll hijack
Auto-extracted: 2 detections for dll hijack
Auto-extracted: 2 detections for api
Auto-extracted: 2 detections for persist
Auto-extracted: 2 detections for dll side
Auto-extracted: 2 detections for office
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for masquerad
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for ransomware
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for file monitoring
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for masquerad
Auto-extracted: 1 detections for api
Auto-extracted: 1 detections for ransomware
Auto-extracted: 1 detections for dns
Auto-extracted: 1 detections for masquerad
Auto-extracted: 1 detections for dll hijack
Auto-extracted: 1 detections for api
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for dll side
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for suspicious