CAPEC-641: DLL Side-Loading
Description
An adversary places a malicious version of a Dynamic-Link Library (DLL) in the Windows Side-by-Side (WinSxS) directory to trick the operating system into loading this malicious DLL instead of a legitimate DLL. Programs specify the location of the DLLs to load via the use of WinSxS manifests or DLL redirection and if they aren't used then Windows searches in a predefined set of directories to locate the file. If the applications improperly specify a required DLL or WinSxS manifests aren't explicit about the characteristics of the DLL to be loaded, they can be vulnerable to side-loading.
- Likelihood of attack
- Low
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Engage in Deceptive Interactions
Prerequisites
- The target must fail to verify the integrity of the DLL before using them.
Skills required
- HighTrick the operating system in loading a malicious DLL instead of a legitimate DLL.
Consequences
- Integrity
Execute Unauthorized Commands; Bypass Protection Mechanism
Mitigations
- Prevent unknown DLLs from loading through using an allowlist policy.
- Patch installed applications as soon as new updates become available.
- Properly restrict the location of the software being used.
- Use of sxstrace.exe on Windows as well as manual inspection of the manifests.
- Require code signing and avoid using relative paths for resources.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-SICASystem Init Config Analysis1 shared
- D3-SBVService Binary Verification1 shared
- D3-SFASystem File Analysis1 shared
- D3-AVEAsset Vulnerability Enumeration1 shared
- D3-RSRestore Software1 shared
- D3-SWISoftware Inventory1 shared
- D3-SUSoftware Update1 shared
- D3-DADynamic Analysis1 shared
- D3-EFAEmulated File Analysis1 shared
- D3-CIConfiguration Inventory1 shared
- D3-RCRestore Configuration1 shared
- D3-EALExecutable Allowlisting1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2014-07-001Service Search Path Interception1 shared
- CAR-2021-11-001Registry Edit with Creation of SafeDllSearchMode Key Set to 01 shared
- CAR-2014-02-001Service Binary Modifications1 shared
- CAR-2013-03-001Reg.exe called from Command Shell1 shared
- CAR-2020-05-003Rare LolBAS Command Lines1 shared
- CAR-2013-01-002Autorun Differences1 shared
- CAR-2013-04-002Quick execution of a series of suspicious commands1 shared