t1574-001-dll

name	T1574.001_dll
description	Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1574.001","persistence","privilege-escalation","defense-evasion","windows","sub-technique"]
technique_id	T1574.001
tactic	persistence
all_tactics	["persistence","privilege-escalation","defense-evasion"]
platforms	["Windows"]
mitre_url	https://attack.mitre.org/techniques/T1574/001
tech_stack	["windows"]
cwe_ids	["CWE-276"]
chains_with	["T1574","T1574.004","T1574.005","T1574.006","T1574.007","T1574.008","T1574.009","T1574.010","T1574.011","T1574.012","T1574.013","T1574.014"]
prerequisites	["T1574"]
severity_boost	{"T1574":"Chain with T1574 for deeper attack path","T1574.004":"Chain with T1574.004 for deeper attack path","T1574.005":"Chain with T1574.005 for deeper attack path"}

T1574.001 DLL

Sub-technique of: T1574

High-Level Description

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Specific ways DLLs are abused by adversaries include:

DLL Sideloading

Adversaries may execute their own malicious payloads by side-loading DLLs. Side-loading involves hijacking which DLL a program loads by planting and then invoking a legitimate application that executes their payload(s).

Side-loading positions both the victim application and malicious payload(s) alongside each other. Adversaries likely use side-loading as a means of masking actions they perform under a legitimate, trusted, and potentially elevated system or software process. Benign executables used to side-load payloads may not be flagged during delivery and/or execution. Adversary payloads may also be encrypted/packed or otherwise obfuscated until loaded into the memory of the trusted process.

Adversaries may also side-load other packages, such as BPLs (Borland Package Library).

Adversaries may chain DLL sideloading multiple times to fragment functionality hindering analysis. Adversaries using multiple DLL files can split the loader functions across different DLLs, with a main DLL loading the separated export functions. Spreading loader functions across multiple DLLs makes analysis harder, since all files must be collected to fully understand the malware’s behavior. Another method implements a “loader-for-a-loader”, where a malicious DLL’s sole role is to load a second DLL (or a chain of DLLs) that contain the real payload.

DLL Search Order Hijacking

Adversaries may execute their own malicious payloads by hijacking the search order that Windows uses to load DLLs. This search order is a sequence of special and standard search locations that a program checks when loading a DLL. An adversary can plant a trojan DLL in a directory that will be prioritized by the DLL search order over the location of a legitimate library. This will cause Windows to load the malicious DLL when it is called for by the victim program.

DLL Redirection

Adversaries may directly modify the search order via DLL redirection, which after being enabled (in the Registry or via the creation of a redirection file) may cause a program to load a DLL from a different location.

Phantom DLL Hijacking

Adversaries may leverage phantom DLL hijacking by targeting references to non-existent DLL files. They may be able to load their own malicious DLL by planting it with the correct name in the location of the missing module.