DLL Search Order Hijacking

Context’s Intelligence and Response teams have seen DLL Search Order being abused as a means of conducting network intrusions in real environments. Abusing the DLL Search Order and taking advantage of this mechanism in order for an application to load a rogue DLL instead of the legitimate one is known as DLL preloading, or (in the MITRE ATT&CK framework) hijacking.

In this blog post, you will find out more about the fundamentals of DLL Search Order and how legitimate binaries can be weaponized, and introduce a tool to automate the discovery of binaries suitable for payload execution via DLL hijacking.