DLL loaded via LdrpKernel32 overwrite

Detects attempts to bypass the standard NTDLL bootstrap process by loading a malicious DLL early through hijacking. The malicious DLL, containing attacker-controlled code, is loaded in place of the legitimate kernel32 DLL.

• Platform: Windows
• Severity: High
• MITRE Tactic: Defense Evasion
• MITRE Techniques: T1574, T1574.001

Back to all rules