DLL Side-Loading via a copied binary

Identifies when a binary is copied to a directory and shortly followed by the loading of an unsigned DLL from the same directory. Adversaries may opt for moving legitimate signed binaries to a random directory and use them to side-load a malicious library.

• Platform: Windows
• Severity: High
• MITRE Tactic: Defense Evasion
• MITRE Techniques: T1574, T1574.002

Back to all rules