DLL Side-loading & Hijacking | DLL Abuse Techniques Overview
Tags
attack-pattern: Dll Search Order Hijacking - T1574.001 Dll Side-Loading - T1574.002 Hooking - T1617 Python - T1059.006 Software - T1592.002 Tool - T1588.002 Vulnerabilities - T1588.006 Connection Proxy - T1090 Dll Search Order Hijacking - T1038 Dll Side-Loading - T1073 Hooking - T1179 Windows Management Instrumentation - T1047 Hooking
Show in Graph
Common Information
Type Value
UUID 90878398-e426-4939-be73-b65122975013
Fingerprint ac1699d9e13f46cd
Analysis status DONE
Considered CTI value 0
Text language
Published Jan. 31, 2020, midnight
Added to db Nov. 9, 2023, 12:24 a.m.
Last updated Oct. 30, 2024, 3:22 a.m.
Headline DLL Side-loading & Hijacking — Using Threat Intelligence to Weaponize R&D
Title DLL Side-loading & Hijacking | DLL Abuse Techniques Overview
Detected Hints/Tags/Attributes 56/1/12
Source URLs
Redirection Url
Details Source https://www.mandiant.com/resources/blog/abusing-dll-misconfigurations
URL Provider
Details Provider Source level domain
Details mandiant.com www.mandiant.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 330 ✔ Threat Intelligence https://www.mandiant.com/resources/blog/rss.xml 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 49 
wmiexec.py
Details File 5 
potplayer.dll
Details File 1 
wmpshare.exe
Details File 3 
wmp.dll
Details File 22 
dism.exe
Details File 11 
dismcore.dll
Details File 1 
subwcrev.exe
Details File 1 
crshhndl.dll
Details File 45 
wmiexec.py
Details File 1 
c:\\temp\\dism.exe
Details md5 2 
f16903b2ff82689404f7d0820f461e5d
Details IPv4 30 
192.168.1.101