← All Chokepoints HIGH

Trusted Binary DLL Side-Loading

A trusted host must map the attacker-controlled DLL before its code can execute.

Defense Evasion Execution T1574.001 Detection difficulty: MEDIUM Prevalence: MEDIUM

Adversaries place an attacker-controlled DLL where a legitimate executable will resolve it, then launch that executable so the Windows loader maps the DLL into the trusted host process. Host names, DLL names, directories, and delivery chains vary, but successful DLL side-loading always produces a host-to-loaded-module relationship that can be observed with image-load telemetry.

By @iimp0ster · Updated 2026-07-16 · View source YAML

Attack Chokepoints 1 invariant stage

Applying the chokepoint framework to Trusted Binary DLL Side-Loading. Learn the framework →

Attacker controls (variables)
  • The legitimate host executable selected for side-loading
  • The malicious DLL contents, filename, and placement path
  • The delivery package, launch mechanism, timing, and surrounding process chain
Attacker cannot control (chokepoints)
  • The selected host process must resolve and map the attacker-controlled DLL before that DLL's code can execute through side-loading
1 Host-to-Module Load ▶
Prerequisites
  • A Windows executable whose DLL resolution behavior can be influenced by placing an attacker-controlled library in a searched location
  • The attacker-controlled file must be a loadable PE library compatible with the selected host process
  • The selected executable must run and invoke the Windows loader for the targeted library
Input A legitimate executable and an attacker-controlled DLL are staged so the executable's DLL resolution behavior selects the attacker-controlled library.
Chokepoint The attacker MUST cause the selected executable to resolve and map the attacker-controlled DLL into its process before the DLL's code can execute.
Observable Windows image-load telemetry records the loading process in Image and the mapped library in ImageLoaded. Sysmon Event ID 7 additionally provides Signed, SignatureStatus, and hash context when configured.
Why unavoidable
If the executable does not map the attacker-controlled DLL, the DLL's code does not execute through side-loading; avoiding this observable requires abandoning DLL side-loading for a different execution technique.
Data Sources
  • Sysmon Event ID 7 (Image Loaded)
  • EDR process/module image-load telemetry
⚠ Bypass risk: Image-load telemetry may be disabled, sampled, or unavailable; signature, path, and local prevalence context must be tuned to the monitored environment.
View rule →

Variations 4 variants tracked

Tools and methods that exploit this chokepoint. The list grows. The chokepoint doesn't change.

JFMBackdoor via fltMC.exe 2026-06-02 Active ▶
PwC reports a legitimate fltMC.exe executable loading FLTLIB.dll in the JFMBackdoor chain. PwC observed the files downloaded into the victim's %TEMP% directory. Active denotes the campaign state reported on 2026-06-02, not independently verified continuing activity.
Same chokepoint: fltMC.exe launched -> Windows loader resolves FLTLIB.dll -> FLTLIB.dll is mapped into fltMC.exe before the backdoor loader executes.
Source: www.pwc.com →
ValleyRAT via GameBox.exe 2026-05-20 Active ▶
K7 Computing documents a legitimate GameBox.exe executable abused to side-load utility.dll from the hidden C:\ProgramData\client working directory in a ValleyRAT delivery chain. Active denotes the campaign state reported on 2026-05-20, not independently verified continuing activity.
Same chokepoint: GameBox.exe launched -> Windows loader resolves utility.dll -> utility.dll is mapped into GameBox.exe before the ValleyRAT chain continues.
Source: labs.k7computing.com →
AGINGFLY via BACHU archive executable 2026-04-20 Active ▶
CERT-UA reports a BACHU archive containing an executable whose launch uses DLL side-loading to start the AGINGFLY loader. The source-grounded handoff does not provide a stable host/DLL filename pair, so this variation is kept name-agnostic rather than filling unsupported values. Active denotes the campaign state reported on 2026-04-20, not independently verified continuing activity.
Same chokepoint: BACHU archive executable launched -> Windows loader resolves the supplied companion library -> the library is mapped into the host to start AGINGFLY.
Source: cert.gov.ua →
HazyBeacon via mscorsvw.exe 2025-07-14 Active ▶
Unit 42 reports a malicious mscorsvc.dll planted in C:\Windows\assembly alongside the legitimate mscorsvw.exe executable. System-path placement changes the context but does not remove the required host-to-module mapping. Active denotes the campaign state reported on 2025-07-14, not independently verified continuing activity.
Same chokepoint: mscorsvw.exe launched -> Windows loader resolves the planted mscorsvc.dll -> mscorsvc.dll is mapped into mscorsvw.exe before HazyBeacon executes.
Source: unit42.paloaltonetworks.com →

Detection Strategy

Rules organized by the chokepoint stage they detect. Each stage has one or more rules at different maturity levels.

1 Host-to-Module Load
Baseline executable-to-DLL image-load relationships
Research High FP
▶
Goal
Baseline executable-to-DLL image-load relationships
Log Sources
  • Sysmon Event ID 7 (Image Loaded)
  • EDR process/module image-load telemetry
FP Rate
High
Use Case
Visibility baseline and host/module relationship inventory
Detection Logic
Record executable processes loading DLLs using Image and ImageLoaded. This is deliberately broad and is intended to establish normal host/module pairs, paths, signatures, and prevalence before applying exclusions.
Sigma Rule - Research Level
GitHub → Download 
title: Executable to DLL Image Load Baseline
id: 2dac8610-edb0-4864-8fd1-a950e94217b2
status: experimental
description: >
  Establishes broad visibility into executable processes loading DLLs so defenders
  can baseline normal host/module relationships before applying side-loading filters.
references:
  - https://attack.mitre.org/techniques/T1574/001/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_from_non_system_location.yml
author: '@iimp0ster'
date: '2026/07/16'
tags:
  - attack.defense-evasion
  - attack.t1574.001
  - detection.maturity.research
logsource:
  product: windows
  category: image_load
detection:
  selection:
    Image|endswith: '.exe'
    ImageLoaded|endswith: '.dll'
  condition: selection
falsepositives:
  - Normal operating-system, application, plug-in, updater, security-tool, and development-runtime DLL loads
level: informational
Hunt executable hosts loading DLLs from higher-risk staging paths
Hunt High FP
▶
Goal
Hunt executable hosts loading DLLs from higher-risk staging paths
Log Sources
  • Sysmon Event ID 7 (Image Loaded)
  • EDR process/module image-load telemetry
FP Rate
High
Use Case
Periodic candidate generation for novel side-loading relationships
Detection Logic
Select executable-to-DLL image loads from user-writable or source-grounded staging paths without filtering valid signatures. Require SIEM-side same-directory, recent-file, first-seen, low-prevalence, signer, and hash enrichment before escalation.
Sigma Rule - Hunt Level
GitHub → Download 
title: Executable Host Loading a DLL From a Higher-Risk Staging Path
id: 324de2a7-a061-478e-a6de-fb694f0b06db
status: experimental
description: >
  Hunts for executable processes loading DLLs from user-writable or source-grounded
  staging paths associated with side-loading. The rule intentionally retains validly
  signed modules; enrich matches with same-directory, recent-file, first-seen,
  signer, hash, and local prevalence context before treating them as malicious.
references:
  - https://attack.mitre.org/techniques/T1574/001/
  - https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml
  - https://github.com/elastic/detection-rules/blob/main/rules_building_block/defense_evasion_dll_hijack.toml
author: '@iimp0ster'
date: '2026/07/16'
tags:
  - attack.defense-evasion
  - attack.t1574.001
  - detection.maturity.hunt
logsource:
  product: windows
  category: image_load
detection:
  selection_load:
    Image|endswith: '.exe'
    ImageLoaded|endswith: '.dll'
  selection_user_staging_path:
    ImageLoaded|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Downloads\'
      - '\Users\Public\'
      - 'C:\Windows\Temp\'
  selection_valleyrat_path:
    ImageLoaded|startswith: 'C:\ProgramData\client\'
  selection_hazybeacon_path:
    ImageLoaded|startswith:
      - 'C:\Windows\assembly\'
      - 'C:\Windows\Microsoft.NET\assembly\'
    ImageLoaded|endswith: '\mscorsvc.dll'
  condition: selection_load and (selection_user_staging_path or selection_valleyrat_path or selection_hazybeacon_path)
falsepositives:
  - Legitimate per-user applications, installers, updaters, plug-ins, and development tools loading DLLs from writable directories
  - Enterprise software installed beneath ProgramData or Windows assembly maintenance activity
  - This portable candidate requires SIEM-side same-directory, recent-file, first-seen, and low-prevalence enrichment before alerting
level: low
Detect reproducible source-grounded host/module pairs in their reported campa...
Analyst Low FP
▶
Goal
Detect reproducible source-grounded host/module pairs in their reported campaign directories
Log Sources
  • Sysmon Event ID 7 (Image Loaded)
  • EDR process/module image-load telemetry
FP Rate
Low
Use Case
SOC alerting after first-seen/rarity, signer, hash, and recent-file enrichment
Detection Logic
Match fltMC.exe/FLTLIB.dll in the reported per-user TEMP directory, or GameBox.exe/utility.dll under C:\ProgramData\client. Normal system-directory basename relationships do not match. AGINGFLY remains Research/Hunt-only because its handoff does not ground filenames or a directory. HazyBeacon also remains Research/Hunt-only until the original vulnerable host or representative assembly-path telemetry can exercise that selection honestly.
Sigma Rule - Analyst Level
GitHub → Download 
title: Reported Trusted Host and DLL Side-Loading Relationships From Reproducible Campaign Paths
id: c0b675e5-cd52-4aca-bfb0-5fb34768982e
status: experimental
description: >
  Detects two executable-to-DLL relationships only when they occur in the
  source-grounded campaign directories reported for JFMBackdoor and ValleyRAT.
  Normal system-directory basename relationships do not match. AGINGFLY does not
  ground filenames or a directory, and the HazyBeacon assembly-path branch remains
  Research/Hunt-only until representative telemetry is available.
references:
  - https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/red-lamassu-open-season.html
  - https://labs.k7computing.com/index.php/fake-microsoft-teams-campaign-delivers-valleyrat-via-nsis-installer-and-dll-sideloading/
author: '@iimp0ster'
date: '2026/07/16'
tags:
  - attack.defense-evasion
  - attack.t1574.001
  - detection.maturity.analyst
logsource:
  product: windows
  category: image_load
detection:
  selection_jfmbackdoor:
    Image|endswith: '\fltMC.exe'
    ImageLoaded|endswith: '\FLTLIB.dll'
    ImageLoaded|contains: '\AppData\Local\Temp\'
  selection_valleyrat:
    Image|startswith: 'C:\ProgramData\client\'
    Image|endswith: '\GameBox.exe'
    ImageLoaded|startswith: 'C:\ProgramData\client\'
    ImageLoaded|endswith: '\utility.dll'
  condition: selection_jfmbackdoor or selection_valleyrat
falsepositives:
  - A legitimate package reproducing one of the exact source-grounded host, module, and directory combinations
  - Require first-seen or low-prevalence host/module-pair enrichment, signer and hash review, and recent-file context before production alerting
level: high

OSINT Pivots

VirusTotal Intelligence attack_technique:T1574.001 have:behavior
Finds behaviorally enriched samples mapped to DLL search-order hijacking. Review process trees and filesystem activity together to extract new executable/DLL relationships; an ATT&CK mapping alone is not sufficient evidence for a variation.
VirusTotal Intelligence (behavior_processes:"fltMC.exe" behavior_files:"FLTLIB.dll") OR (behavior_processes:"GameBox.exe" behavior_files:"utility.dll") OR (behavior_processes:"mscorsvw.exe" behavior_files:"mscorsvc.dll")
Expands the three filename-grounded seed relationships into related samples and submissions. Pivot from matching samples to parents, bundled files, behavior similarity, and first-seen metadata to identify campaign or packaging changes.
HijackLibs CSV dataset; filter Type = DLL Sideloading
Download the maintained executable-to-library mapping and filter it to DLL Sideloading entries. Treat candidates as hunt seeds and require independent in-the-wild or sandbox evidence before promoting one as a threat variation.
GitHub Code Search "T1574.001" ("DLL side-loading" OR "DLL sideloading") language:Markdown
Finds newly published threat reports, research notes, and detection repositories that name the ATT&CK technique. Extract a variation only when the source grounds both the legitimate host and the attacker-controlled module relationship.

References