Untrusted DLL loaded from masqueraded Windows directory
Identifies trusted process executables loading unsigned or untrusted Dynamic Link Libraries (DLLs) from filesystem paths that masquerade as legitimate Windows system directories. Attackers frequently create lookalike directory structures to disguise malicious payloads as legitimate operating system components.
- Plataforma: Windows
- Severidad: High
- Táctica MITRE: Escalada de privilegios
- Técnicas MITRE: T1574