DLL Side-Loading via a copied binary
Identifies when a binary is copied to a directory and shortly followed by the loading of an unsigned DLL from the same directory. Adversaries may opt for moving legitimate signed binaries to a random directory and use them to side-load a malicious library.
- Plataforma: Windows
- Severidad: High
- Táctica MITRE: Evasión de defensas
- Técnicas MITRE: T1574, T1574.002