Phantom DLL Loading

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
Detector Tags	DLL Hijacking Analytics
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	Hijack Execution Flow: DLL (T1574.001)
Severity	Medium

Description

An attacker might leverage existing processes missing module loads to load malicious code into trusted processes.

Attacker's Goals

An attacker is attempting to load untrusted code into trusted contexts to avoid detection, persist or escalate privileges.

Investigative actions

Investigate the loaded module and verify if it is malicious.

Variations

Phantom DLL Loading was used to load a DLL into a process after it was extracted from an internet-downloaded archive

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	Hijack Execution Flow: DLL (T1574.001)
Severity	High

Description

An attacker might leverage existing processes missing module loads to load malicious code into trusted processes.

Attacker's Goals

An attacker is attempting to load untrusted code into trusted contexts to avoid detection, persist or escalate privileges.

Investigative actions

Investigate the loaded module and verify if it is malicious.

Phantom DLL Loading was used to load a DLL into a process after it was downloaded from an uncommon source

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	Hijack Execution Flow: DLL (T1574.001)
Severity	High

Description

An attacker might leverage existing processes missing module loads to load malicious code into trusted processes.

Attacker's Goals

An attacker is attempting to load untrusted code into trusted contexts to avoid detection, persist or escalate privileges.

Investigative actions

Investigate the loaded module and verify if it is malicious.