Attack Ent T1574 001 Dll

MITRE ATT&CK T1574.001: DLL

When to use this skill

Use this skill when the task involves T1574.001, DLL, enterprise ATT&CK, TTP mapping, detection engineering, hunting, incident-response enrichment, control validation, or authorized adversary-emulation planning. Treat it as a defensive analysis aid: keep outputs focused on understanding, detecting, mitigating, and safely validating this ATT&CK sub-technique.

Technique context

• ATT&CK domain: enterprise
• ATT&CK ID: T1574.001
• Technique name: DLL
• Type: sub-technique
• ATT&CK URL: https://attack.mitre.org/techniques/T1574/001
• Tactics: execution, stealth
• Platforms: Windows
• Required permissions: Not specified
• Effective permissions: Not specified
• Defenses bypassed: Not specified

ATT&CK description

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.(Citation: unit 42)

Specific ways DLLs are abused by adversaries include:

DLL Sideloading

Adversaries may execute their own malicious payloads by side-loading DLLs. Side-loading involves hijacking which DLL a program loads by planting and then invoking a legitimate application that executes their payload(s).

Side-loading positions both the victim application and malicious payload(s) alongside each other. Adversaries likely use side-loading as a means of masking actions they perform under a legitimate, trusted, and potentially elevated system or software process. Benign executables used to side-load payloads may not be flagged during delivery and/or execution. Adversary payloads may also be encrypted/packed or otherwise obfuscated until loaded into the memory of the trusted process.

Adversaries may also side-load other packages, such as BPLs (Borland Package Library).(Citation: kroll bpl)

Adversaries may chain DLL sideloading multiple times to fragment functionality hindering analysis. Adversaries using multiple DLL files can split the loader functions across different DLLs, with a main DLL loading the separated export functions. (Citation: Virus Bulletin) Spreading loader functions across multiple DLLs makes analysis harder, since all files must be collected to fully understand the malware’s behavior. Another method implements a “loader-for-a-loader”, where a malicious DLL’s sole role is to load a second DLL (or a chain of DLLs) that contain the real payload. (Citation: Sophos)

DLL Search Order Hijacking

Adversaries may execute their own malicious payloads by hijacking the search order that Windows uses to load DLLs. This search order is a sequence of special and standard search locations that a program checks when loading a DLL. An adversary can plant a trojan DLL in a directory that will be prioritized by the DLL search order over the location of a legitimate library. This will cause Windows to load the malicious DLL when it is called for by the victim program.(Citation: unit 42)

DLL Redirection

Adversaries may directly modify the search order via DLL redirection, which after being enabled (in the Registry or via the creation of a redirection file) may cause a program to load a DLL from a different location.(Citation: Microsoft redirection)(Citation: Microsoft - manifests/assembly)

Phantom DLL Hijacking

Adversaries may leverage phantom DLL hijacking by targeting references to non-existent DLL files. They may be able to load their own malicious DLL by planting it with the correct name in the location of the missing module.(Citation: Hexacorn DLL Hijacking)(Citation: Hijack DLLs CrowdStrike)

DLL Substitution

Adversaries may target existing, valid DLL files and substitute them with their own malicious DLLs, planting them with the same name and in the same location as the valid DLL file.(Citation: Wietze Beukema DLL Hijacking)

Programs that fall victim to DLL hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace, evading defenses.

Remote DLL hijacking can occur when a program sets its current directory to a remote location, such as a Web share, before loading a DLL.(Citation: dll pre load owasp)(Citation: microsoft remote preloading)

If a valid DLL is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation.

Agent workflow

1. Clarify scope: identify the system, asset class, log sources, cloud or endpoint platform, and whether the user wants triage, detection, coverage assessment, or safe emulation planning.
2. Load bundled resources as needed: use references/technique-profile.json for structured metadata, references/detection-and-mitigation.md for triage and telemetry guidance, references/known-threat-context.md for ATT&CK relationship context, and templates/ for repeatable outputs.
3. Map observations to ATT&CK: compare the user's evidence to the ATT&CK description, tactics, platforms, and known procedure patterns before asserting a match.
4. Produce defensive outputs: prioritize hypotheses, telemetry requirements, detection logic ideas, validation steps, containment guidance, and mitigations.
5. Preserve uncertainty: distinguish confirmed evidence, plausible indicators, assumptions, and gaps. Recommend what to collect next.
6. Stay safe: do not provide malware, credential theft, persistence, evasion, destructive automation, or unauthorized exploitation instructions. For adversary emulation, keep steps bounded to approved lab or control-validation contexts and omit operational abuse details.

Bundled resources

• references/technique-profile.json: machine-readable ATT&CK metadata for this technique.
• references/detection-and-mitigation.md: detection notes, telemetry checklist, triage questions, mitigation candidates, and false-positive considerations.
• references/known-threat-context.md: ATT&CK relationship context with attribution cautions.
• templates/detection-brief.md: detection engineering brief template.
• templates/hunt-plan.md: threat hunt plan template.
• templates/incident-response-note.md: incident response note template.
• templates/coverage-assessment.md: ATT&CK coverage assessment template.
• scripts/render_brief.py: local helper that renders a Markdown defensive brief from technique-profile.json.
• assets/output-schema.json: JSON schema for structured technique analysis outputs.

To generate a quick brief, run python scripts/render_brief.py --output brief.md from inside this skill directory, or adapt the templates directly.

Detection guidance

No ATT&CK detection guidance was present in the source STIX object.

Useful telemetry and data sources

• Not specified in the STIX object.

Mitigations to consider

• Application Developer Guidance
• Audit
• Execution Prevention
• Restrict Library Loading
• Update Software

Known threat context

Use these examples only as contextual leads, not as proof that an observed event is this technique:

• 3CX Supply Chain Attack (campaign)
• ANELLDR (malware)
• APT-C-36 (intrusion-set)
• APT19 (intrusion-set)
• APT3 (intrusion-set)
• APT32 (intrusion-set)
• APT41 (intrusion-set)
• APT41 DUST (campaign)
• Aquatic Panda (intrusion-set)
• AshTag (malware)
• Astaroth (malware)
• BADNEWS (malware)
• BBSRAT (malware)
• BOOKWORM (malware)
• BOOSTWRITE (malware)
• BRONZE BUTLER (intrusion-set)
• BackdoorDiplomacy (intrusion-set)
• BlackTech (intrusion-set)
• Brute Ratel C4 (tool)
• CANONSTAGER (malware)

Recommended output pattern

When responding with this skill, structure the answer as:

• Assessment: whether the evidence supports this ATT&CK mapping and why.
• Evidence: specific indicators, logs, behaviors, and assumptions.
• Detection: telemetry sources, analytic logic, and tuning considerations.
• Response: containment, eradication, recovery, and validation actions.
• Coverage gaps: missing logs, sensors, controls, or environmental details.
• References: include the ATT&CK URL and any user-provided evidence references.

ATT&CK contributors

• Ami Holeston, CrowdStrike
• Hajime Yanagishita, Macnica, Inc.
• Marina Liang
• Stefan Kanthak
• Suguru Ishimaru, ITOCHU Cyber & Intelligence Inc.
• Travis Smith, Tripwire
• Wietze Beukema @Wietze
• Will Alexander, CrowdStrike
• Yusuke Niwa, ITOCHU Cyber & Intelligence Inc.