DLL hijacking is a technique in which an attacker makes a Windows program load a malicious DLL instead of the legitimate library, so the attacker’s code runs inside a trusted process.
How DLL hijacking works
Windows programs load dynamic-link libraries (DLLs) by name. If the full path is not specified, Windows searches a sequence of locations – the application’s directory, system folders, the current directory and folders in the PATH variable. An attacker who can write to a location that is searched earlier than the legitimate one can plant a DLL with the same name. Variants include:
- Search order hijacking – placing the DLL in a directory checked before the real one.
- Phantom DLL hijacking – supplying a DLL that the program tries to load but that does not exist on the system.
- DLL replacement – overwriting a legitimate DLL in a writable folder.
Closely related is DLL sideloading, where attackers bring their own legitimate signed executable together with a malicious DLL. MITRE ATT&CK groups these methods under Hijack Execution Flow (T1574), and the underlying weakness is CWE-427 (Uncontrolled Search Path Element).
Why DLL hijacking matters
The malicious code runs under a legitimate, often digitally signed program, which helps it evade security tools. Attackers use DLL hijacking for persistence, stealth and privilege escalation when a service running as SYSTEM loads a library from a folder ordinary users can write to. The problem is old: in 2010 Microsoft published Security Advisory 2269637 about insecure library loading, after researchers showed that many popular applications could be tricked into loading DLLs from network shares.
How to protect against DLL hijacking
- Developers should load libraries with full paths and use APIs such as SetDefaultDllDirectories to restrict the search order.
- Keep Safe DLL Search Mode enabled and prevent non-admin users from writing to program and PATH folders.
- Use application control (WDAC, AppLocker) with DLL rules.
- Monitor for unsigned DLLs loaded by signed processes or from unusual paths.
