Potential privilege escalation via phantom DLL hijacking

Identifies the loading of the phantom DLL that was previously dropped to the System directory. Adversaries may exploit this flow to escalate privileges by placing a custom version of the DLL and initiating the execution of an auto-elevated high integrity Windows native process.

• Platform: Windows
• Severity: High
• MITRE Tactic: Privilege Escalation
• MITRE Techniques: T1574, T1574.001

Back to all rules