Possible DLL Search Order Hijacking

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent
Detection Modules
Detector Tags	DLL Hijacking Analytics
ATT&CK Tactic	Persistence (TA0003) Privilege Escalation (TA0004) Defense Evasion (TA0005)
ATT&CK Technique	Hijack Execution Flow: DLL Search Order Hijacking (T1574.001) Hijack Execution Flow: Path Interception by PATH Environment Variable (T1574.007) Hijack Execution Flow: Path Interception by Unquoted Path (T1574.009) Hijack Execution Flow: Path Interception by Search Order Hijacking (T1574.008)
Severity	Low

An attacker might abuse the Windows DLL search order to trigger known, signed processes to load the attacker's malicious module.

An attacker is attempting to load an untrusted module into a trusted context to avoid detection, gain persistence or to perform privilege escalation.

Investigate the loaded module to verify if it is malicious.
Investigate if the loading process and the loaded module reside in legitimate locations.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

An attacker might abuse the Windows DLL search order to trigger known, signed processes to load the attacker's malicious module.

An attacker is attempting to load an untrusted module into a trusted context to avoid detection, gain persistence or to perform privilege escalation.

Investigate the loaded module to verify if it is malicious.
Investigate if the loading process and the loaded module reside in legitimate locations.