Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft Dynamic Link Library Search Order)(Citation: FireEye Hijacking July 2010) Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.

There are many ways an adversary can hijack DLL loads. Adversaries may plant trojan dynamic-link library files (DLLs) in a directory that will be searched before the location of a legitimate library that will be requested by a program, causing Windows to load their malicious library when it is called for by the victim program. Adversaries may also perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program.(Citation: FireEye fxsst June 2011) Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. (Citation: Microsoft Security Advisory 2269637)

Phantom DLL hijacking is a specific type of DLL search order hijacking where adversaries target references to non-existent DLL files.(Citation: Adversaries Hijack DLLs) They may be able to load their own malicious DLL by planting it with the correct name in the location of the missing module.

Adversaries may also directly modify the search order via DLL redirection, which after being enabled (in the Registry and creation of a redirection file) may cause a program to load a different DLL.(Citation: Microsoft Dynamic-Link Library Redirection)(Citation: Microsoft Manifests)(Citation: FireEye DLL Search Order Hijacking)

If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program. Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace.
DLL Search Order Hijacking
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1574/001  external_id: T1574.001     source_name: Adversaries Hijack DLLs  description: CrowdStrike, Falcon OverWatch Team. (2022, December 30). Retrieved October 19, 2023.  url: https://www.crowdstrike.com/blog/4-ways-adversaries-hijack-dlls/     source_name: FireEye Hijacking July 2010  description: Harbour, N. (2010, July 15). Malware Persistence without the Windows Registry. Retrieved November 17, 2020.  url: https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html     source_name: FireEye fxsst June 2011  description: Harbour, N. (2011, June 3). What the fxsst?. Retrieved November 17, 2020.  url: https://www.fireeye.com/blog/threat-research/2011/06/fxsst.html     source_name: Microsoft Security Advisory 2269637  description: Microsoft. (, May 23). Microsoft Security Advisory 2269637. Retrieved March 13, 2020.  url: https://docs.microsoft.com/en-us/security-updates/securityadvisories/2010/2269637     source_name: Microsoft Dynamic-Link Library Redirection  description: Microsoft. (2018, May 31). Dynamic-Link Library Redirection. Retrieved March 13, 2020.  url: https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection?redirectedfrom=MSDN     source_name: Microsoft Dynamic Link Library Search Order  description: Microsoft. (2018, May 31). Dynamic-Link Library Search Order. Retrieved November 30, 2014.  url: https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order?redirectedfrom=MSDN     source_name: Microsoft Manifests  description: Microsoft. (n.d.). Manifests. Retrieved December 5, 2014.  url: https://msdn.microsoft.com/en-US/library/aa375365     source_name: FireEye DLL Search Order Hijacking  description: Nick Harbour. (2010, September 1). DLL Search Order Hijacking Revisited. Retrieved March 13, 2020.  url: https://www.fireeye.com/blog/threat-research/2010/08/dll-search-order-hijacking-revisited.html     source_name: OWASP Binary Planting  description: OWASP. (2013, January 30). Binary planting. Retrieved June 7, 2016.  url: https://www.owasp.org/index.php/Binary_planting     