Full Report
Actionable guide to hunting for the DLL side-loading threat by using Group-IB MXDR.
Analysis Summary
# Tool/Technique: DLL Side-Loading
## Overview
DLL side-loading is a technique where an attacker exploits the way Microsoft Windows handles the loading of dynamic-link libraries (DLLs). By placing a malicious DLL with a legitimate name in the same directory as a trusted, digitally signed executable, the attacker tricks the operating system into loading the malicious file instead of the legitimate one. This is primarily used to execute code under the context of a trusted process to evade security software.
## Technical Details
- **Type**: Technique
- **Platform**: Windows
- **Capabilities**: Evasion of security controls, persistence, execution of unauthorized code within trusted process memory.
- **First Seen**: This is a long-standing technique, though the specific variant in the case study (using `Acrobat.exe`) is a common contemporary observation.
## MITRE ATT&CK Mapping
- **TA0002 - Execution**
- T1574.002 - Hijack Execution Flow: DLL Side-Loading
- **TA0003 - Persistence**
- T1053.005 - Scheduled Task/Job: Scheduled Task
- **TA0005 - Defense Evasion**
- T1574.002 - Hijack Execution Flow: DLL Side-Loading
- T1027 - Obfuscated Files or Information
## Functionality
### Core Capabilities
- **Search Order Hijacking**: Exploits the Windows side-by-side (WinSxS) assembly or the default directory search order where the application directory is prioritized over system directories.
- **Trust Exploitation**: Leverages a legitimate, often digitally signed, third-party executable to bypass application whitelisting and signature-based detection.
- **Proxy Loading**: The malicious DLL often contains code to load the "real" original DLL functions to ensure the legitimate application continues to run without crashing, masking the presence of the malware.
### Advanced Features
- **Persistence Integration**: Often coupled with Scheduled Tasks or Registry Run keys to ensure the signed executable (and subsequently the malicious DLL) runs upon system boot or user login.
- **Memory Injection**: Once loaded, the malicious DLL often serves as a loader for more complex payloads (e.g., Cobalt Strike, PlugX) directly into memory.
## Indicators of Compromise
- **File Names**:
- `Acrobat.exe` (Legitimate signed file moved to a non-standard directory)
- `Acrobat.dll` (Malicious unsigned file in the same directory as the executable)
- **File Paths**:
- `C:\ProgramData\Acrobat\AcrobatAey\` (Non-standard location for Adobe binaries)
- **Behavioral Indicators**:
- A signed executable loading an unsigned DLL from the same folder.
- `schtasks.exe` commands creating tasks that point to binaries in `C:\ProgramData\`.
- Legitimate binaries (like Acrobat, OneDrive, or GCM) spawned as children of `taskeng.exe` or `svchost.exe` from unusual paths.
## Associated Threat Actors
- **APT Groups**: Widely used by Chinese-affiliated actors (e.g., Mustang Panda, APT41).
- **Ransomware Operators**: Used by various groups to deploy initial access tools.
## Detection Methods
- **Behavioral Detection**: Monitoring for "Module Load" events where the `ImageFileSign.TrustStatus` of the executable is "Trusted" (signed) but the loaded DLL is "Unsigned" or "Unknown."
- **EDR Querying**: Hunting for processes where the `ImageFileName` is a known legitimate tool but the file path is suspicious (e.g., `\ProgramData\` or `\Temp\`).
- **Telemetry Analysis**: Searching for `schtasks.exe` executions that reference executables in writeable user directories.
## Mitigation Strategies
- **Path Restrictions**: Prevent executables from running out of non-standard, user-writable directories like `C:\ProgramData\` or `C:\Users\Public\` via AppLocker or Windows Defender Application Control (WDAC).
- **DLL Search Order Hardening**: Developers should use `SetDefaultDllDirectories` to restrict DLL loads to specific secure folders.
- **Least Privilege**: Ensure users do not have administrative rights, limiting their ability to register scheduled tasks or write to system-wide folders.
## Related Tools/Techniques
- **DLL Search Order Hijacking**: A broader category of which side-loading is a specific subset.
- **Phantom DLL Hijacking**: Exploiting attempts by an application to load a DLL that does not exist.
- **Binary Planting**: The general act of placing a malicious binary in a location where it will be executed by a legitimate process.