Log in Request a demo

Attack technique

DLL

DLL hijacking is when an attacker abuses the shared library files (DLLs) that Windows programs load.

In short

DLL hijacking is when an attacker abuses the shared library files (DLLs) that Windows programs load. A trusted program is made to load a harmful DLL instead of, or alongside, the real one. This helps the attacker stay in place, gain higher privileges and avoid detection.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact
  1. MITRE IDT1574.001ATT&CK technique
  2. Detection4ways to spot itUnexpected DLL loads · Replaced or extra DLLs
  3. Defences4ways to stop itControl library loading · Use application control

How it works

DLLs are libraries of code that many programs share. They are not harmful by nature, but the way programs find and load them can be abused.

MITRE describes several forms. In DLL side-loading, the attacker places a harmful DLL next to a legitimate application, so the application loads it. In search order hijacking, a harmful DLL is placed in a folder that Windows checks before the folder holding the real library. Other forms include redirecting where a program looks, using a DLL that is referenced but missing, and swapping a real DLL for a fake one.

Because the trusted program runs the code, the activity can look normal. Some harmful DLLs also load the real library, so the program seems to work as usual. If the program runs with high privileges, the harmful code runs with them too.

A real example

Procedure examples listed by MITRE ATT&CK:

  • ANELLDR can use DLL sideloading from a legitimate application to start execution.
  • AshTag has used DLL sideloading, pairing a legitimate executable with a malicious DLL named wtsapi32.
  • Astaroth can launch itself through DLL search order hijacking.
  • BADNEWS typically loads its DLL file into a legitimate signed Java or VMware executable.
  • BBSRAT was run through DLL side-loading, using a legitimate executable that the dropper placed next to it.
  • Siemens says attackers placed their own DLL files next to a genuine, signed copy of Software Center, which loaded them without checking. It is tracked as CVE-2026-110936, and CISA lists it as exploited.

How to detect

  1. Unexpected DLL loads

    Watch for trusted programs that load DLLs from folders they do not normally use.

  2. Replaced or extra DLLs

    Look for DLLs that have been swapped, added where none existed before, or set up through redirection files.

  3. Combine several data sources

    Link file changes, registry changes and module load records, so odd DLL behavior inside a trusted process stands out.

  4. Detection strategy MITRE lists

    DET0201, Detection Strategy for Hijack Execution Flow for DLLs.

How to defend

  1. Control library loading

    Block the loading of remote DLLs and keep safe DLL search mode switched on. Both are default in modern Windows.

  2. Use application control

    Use tools that can block DLLs loaded by legitimate software, not only the programs themselves.

  3. Audit for weak spots

    Run auditing tools that find DLL search order weaknesses on company systems, then fix them.

  4. Patch and harden software

    Keep software updated to fix side-loading flaws. Developers can add hash values to manifest files to help stop side-loading.

Questions

What is DLL hijacking?

DLL hijacking is when an attacker abuses the shared library files (DLLs) that Windows programs load. A trusted program is made to load a harmful DLL instead of, or alongside, the real one, so the activity can look normal.

What is the difference between DLL side-loading and search order hijacking?

In DLL side-loading, the attacker places a harmful DLL next to a legitimate application so it loads it. In search order hijacking, the harmful DLL sits in a folder that Windows checks before the folder holding the real library.

How can defenders detect DLL hijacking?

Watch for trusted programs that load DLLs from folders they do not normally use, and for DLLs that were swapped or added. Linking file changes, registry changes and module load records makes odd behavior inside a trusted process stand out.

How do I defend against DLL hijacking?

Block the loading of remote DLLs and keep safe DLL search mode on, use application control that can block DLLs loaded by legitimate software, audit for search order weaknesses and keep software updated.

In our research

  1. BRONZE SANDCASTLE: Sandboxie DLL Sideloading Chain and Detection Checks October 2026
  2. Storm-2603 ToolShell Intrusion: The Fileless Chain Inside w3wp.exe, Step by Step November 2026
  3. SlippyNunchucks Hijacks Sogou Input Method Lookups to Deliver DarkVigil: The Attack Chain Step by Step November 2026
  4. VAPOR PANDA and ARTEX: How AI Agents Ran a China-Nexus Espionage Campaign October 2026
  5. BlackX UEFI Bootkit Step by Step: Why Patched Windows Still Fell October 2026
  6. Kaspersky: Lazarus Hides Malware Payloads With Post-Quantum Encryption in Operation FlashHole October 2026

Sources

  1. MITRE ATT&CK T1574.001: Hijack Execution Flow: DLL MITRE
  2. MITRE ATT&CK T1574: Hijack Execution Flow MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

APT19

MITRE ATT&CK describes APT19 (also Codoso) as a Chinese-based group that has targeted defense, finance, legal and other industries, with activity reported in 2014 and 2017. Only MITRE ATT&CK documents this group, no government advisory names it, and MITRE says it is unclear whether APT19 and Deep Panda are the same group.

Read more

Threat group

APT27 threat group profile

Attributed by MITRE ATT&CK and by the US Department of Justice (5 March 2025) to a Chinese group, also called Threat Group-3390 and Emissary Panda, that targets governments and companies. The Justice Department charged two men it calls APT27 actors, alleging profit-driven hacking from 2013 to 2024.

Read more