T1574.001ExecutionStealth
DLL
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking. Specific ways…
CVEs4
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.3
Reports1
Detections
93 Sigma rules tagged T1574.001DLLT1574.00193 general rules
- Winnti Pipemon Characteristicscriticalstable
- APT27 - Emissary Panda Activitycriticaltest
- Winnti Malware HK University Campaigncriticaltest
- Suspicious Unsigned Thor Scanner Executionhighstable
- Aruba Network Service Potential DLL Sideloadinghightest
- DHCP Callout DLL Installationhightest
- DHCP Server Error Failed Loading the CallOut DLLhightest
- DHCP Server Loaded the CallOut DLLhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to DLL
4 CVEs, by priority. Each link shows its badge.- CVE-2020-3153Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path VulnerabilityCisco · AnyConnect SecureKEVRansomwarePublic exploitMedium · 6.5T1078Valid AccountsT1574.001DLL+1 moreAI mapping from the description · primary impact28.5%Top 1.9%77.2priority
- CVE-2012-1854Microsoft Visual Basic for Applications Insecure Library Loading VulnerabilityAI mapping from the description · primary impact20.9%Top 2.5%63.0priority
- CVE-2024-7262Kingsoft WPS Office Path Traversal VulnerabilityAI mapping from the description · primary impact3.1%Top 12%61.0priority
- CVE-2019-10971The application (Network Configurator for DeviceNet Safety 3.41 and prior) searches for resources by means of an…MITRE CTID mapping of the CVE · primary impact1.1%Top 36%12.9priority