DLL sideloading is a technique in which attackers place a malicious DLL next to a legitimate, often digitally signed, Windows program so that the program loads and runs the attacker’s code.
How DLL sideloading works
Windows programs load dynamic-link libraries (DLLs) by name. When a DLL is not specified with a full path, Windows searches several locations, starting with the application’s own folder. Attackers take a legitimate executable that expects a certain DLL – for example a component of an antivirus, a media player or a vendor update tool – copy it to a folder together with a malicious DLL of the same name, and run it. The trusted program loads the malicious library, which executes the payload and often forwards calls to the real DLL so that everything keeps working.
MITRE ATT&CK lists this under Hijack Execution Flow (T1574), alongside related DLL search-order hijacking techniques.
Why it matters
- The malicious code runs inside a signed, reputable process, which helps it evade EDR and application allowlisting.
- Network connections and file activity appear to come from a trusted program.
- Attackers can deliver the trio “legitimate EXE + malicious DLL + encrypted payload” in an archive or ISO file.
DLL sideloading has been a hallmark of APT groups for over a decade, especially with the PlugX and ShadowPad malware families, and is now widely used by ransomware and infostealer operators. It fits well with living-off-the-land tactics that abuse trusted software.
How to detect and prevent
- Alert when signed programs run from unusual locations such as user Temp or Downloads folders.
- Monitor for unsigned DLLs loaded by signed processes and for known vulnerable executables.
- Use application control (WDAC, AppLocker) with DLL rules, and restrict write access to program folders.
- Developers should load DLLs with full paths and secure search-order settings.
