How to Detect DLL Sideloading and DLL Hijacking Attacks

How DLL search order creates the vulnerability:

Windows DLL search order (SafeDllSearchMode ON):
1. Directories listed in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs
2. The directory from which the application loaded
3. The system directory (C:\Windows\System32)
4. The 16-bit system directory
5. The Windows directory (C:\Windows)
6. The current directory
7. Directories listed in PATH environment variable

Step 2 (application directory) is the attack surface:
- If malware places malicious.dll in the same directory as legitapp.exe,
  and legitapp.exe calls LoadLibrary("malicious.dll"),
  Windows loads the malicious version from step 2 before finding the real one in step 3

Common vulnerable scenarios:

Scenario 1: Missing dependency:
  legitapp.exe expects DWrite.dll from System32
  Attacker creates C:\Users\Public\App\DWrite.dll (malicious)
  Attacker also places legitapp.exe in C:\Users\Public\App\\n  legitapp.exe loads malicious DWrite.dll from its own directory

Scenario 2: DLL phantom loading:
  Some applications call LoadLibrary() for DLLs that don't exist on the system
  The DLL load fails silently, but an attacker can create the DLL at the expected path
  Process Monitor can identify phantom DLL loads (NAME NOT FOUND results for DLL lookups)

Scenario 3: PATH hijacking:
  Application expects a DLL in a PATH directory
  Attacker places malicious DLL earlier in PATH (writable directory)

# Identify vulnerable signed binaries:
# Use Process Monitor (Sysinternals) filtered on "NAME NOT FOUND" for .dll files
# These are candidates for phantom DLL hijacking

Sysmon Event ID 7 (Image Loaded) is the primary detection source: it logs every DLL load with the DLL path and signature status.

Enable Event ID 7 in Sysmon config:

<EventFiltering>
  <ImageLoad onmatch="exclude">
    <!-- Exclude known-good DLL load paths to reduce volume -->
    <ImageLoaded condition="begin with">C:\Windows\System32\</ImageLoaded>
    <ImageLoaded condition="begin with">C:\Windows\SysWOW64\</ImageLoaded>
    <ImageLoaded condition="begin with">C:\Program Files\</ImageLoaded>
    <ImageLoaded condition="begin with">C:\Program Files (x86)\</ImageLoaded>
    <!-- Exclude signed Microsoft DLLs -->
    <Signed condition="is">true</Signed>  <!-- Caution: may miss signed-but-sideloaded DLLs -->
  </ImageLoad>
</EventFiltering>
<!-- Note: Event ID 7 is high volume: tune exclusions carefully -->

Better approach: include only anomalous loads:

<ImageLoad onmatch="include">
  <!-- Unsigned DLLs loaded from non-standard locations -->
  <ImageLoaded condition="contains">\.dll</ImageLoaded>
  <!-- The Signed field helps: unsigned DLL loaded by signed process = suspicious -->
</ImageLoad>

Sentinel KQL: unsigned DLL loaded by signed process:

// Detect sideloading: signed process loading unsigned DLL from unusual path
Event
| where Source == "Microsoft-Windows-Sysmon" and EventID == 7
| extend EventData = parse_xml(EventData)
| extend
    Image = tostring(EventData.DataItem.EventData.Data[4]["#text"]),  // Loading process
    ImageLoaded = tostring(EventData.DataItem.EventData.Data[6]["#text"]),  // DLL path
    Signed = tostring(EventData.DataItem.EventData.Data[10]["#text"]),
    SignatureStatus = tostring(EventData.DataItem.EventData.Data[12]["#text"])
| where Signed == "false"
// Exclude known-safe paths
| where ImageLoaded !startswith @"C:\Windows\\"
    and ImageLoaded !startswith @"C:\Program Files\\"
// Flag unsigned DLLs loaded from user-writable locations
| where ImageLoaded matches regex @"(?i)(\\temp\\|\\appdata\\|\\users\\|\\downloads\\|\\public\\)"
| summarize
    count(),
    make_set(ImageLoaded)
    by Image, Computer, bin(TimeGenerated, 1h)
| sort by count_ desc

Detect DLL loaded from same directory as suspicious executable:

Event
| where Source == "Microsoft-Windows-Sysmon" and EventID == 7
| extend EventData = parse_xml(EventData)
| extend
    Image = tostring(EventData.DataItem.EventData.Data[4]["#text"]),
    ImageLoaded = tostring(EventData.DataItem.EventData.Data[6]["#text"]),
    Signed = tostring(EventData.DataItem.EventData.Data[10]["#text"])
// Extract directory of loading process
| extend ProcessDir = tostring(split(Image, "\\")[0..array_length(split(Image, "\\"))-2])
// Extract directory of loaded DLL
| extend DLLDir = tostring(split(ImageLoaded, "\\")[0..array_length(split(ImageLoaded, "\\"))-2])
// DLL is in same directory as the loading executable (sideloading pattern)
| where ProcessDir == DLLDir
    and Signed == "false"
    and ProcessDir !startswith @"C:\Windows"
    and ProcessDir !startswith @"C:\Program Files"
| project TimeGenerated, Computer, Image, ImageLoaded, ProcessDir

Find sideloadable binaries in your environment:

# Use SigCheck (Sysinternals) to find signed executables that load unsigned DLLs:
SigCheck64.exe -accepteula -c -h C:\Tools\AppDirectory\
# Look for: signed executables that reference unsigned DLLs in the same directory

# Use Process Monitor during application testing:
# Filter: Result = NAME NOT FOUND; Path ends with .dll
# These are phantom DLL load attempts: if an attacker places a DLL with that name
# in the application directory, it will be loaded

# Tools for finding hijackable DLLs:
# DLLSpy: https://github.com/cyberark/DLLSpy
# RobbinHood (deprecated): scans for vulnerable DLL search paths

# PowerShell: find directories in PATH that are user-writable
$env:PATH -split ';' | ForEach-Object {
    $dir = $_
    try {
        $acl = Get-Acl $dir -ErrorAction Stop
        $writable = $acl.Access | Where-Object {
            $_.FileSystemRights -match 'Write|FullControl|Modify' -and
            $_.IdentityReference -match 'Users|Authenticated Users|Everyone'
        }
        if ($writable) { "WRITABLE: $dir" }
    } catch { "NOT FOUND: $dir" }
}
# Writable PATH directories are DLL hijacking candidates

Hardening against DLL sideloading:

1. Application directory permissions: Do not allow non-admin users to write to application installation directories. Use icacls to verify:

icacls "C:\Program Files\VendorApp" | \
  Select-String "Users|Everyone" | \
  Where-Object { $_ -match 'W|F|M' }
# Any write permission for Users/Everyone = DLL sideloading risk

1. Enable SafeDllSearchMode: The registry value HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode = 1 (default in modern Windows) moves the current directory search to after system directories: reduces hijacking risk but not sideloading from application directories.

2. WDAC or AppLocker DLL rules: Configure Windows Defender Application Control to only allow signed DLLs from approved publishers. Note: DLL rules have high performance overhead and require thorough testing.

3. Vendor notification: If you identify a vendor application that sideloads vulnerable DLLs, notify the vendor: this is a vulnerability in their product that they should fix by using fully qualified paths or manifest-based loading.