Techniques › T1574.001 › AN0577
AN0577 Analytic 0577
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>DLL hijacking behaviors including unexpected DLL loads from non-standard directories, replacement of DLLs, phantom DLL insertion, redirection file creation, and substitution of legitimate DLLs. Defender correlates file system modifications, registry changes, and module load telemetry to detect abnormal DLL behavior in trusted processes.</p>
- Detects
- T1574.001 DLL
- Part of
- DET0201 Detection Strategy for Hijack Execution Flow for DLLs
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Sysmon | EventCode=15 | DC0059 File Metadata |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
| WinEventLog:Security | EventCode=4657 | DC0063 Windows Registry Key Modification |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AllowedDllPaths | Known safe DLL directories to suppress false positives (e.g., C:\Windows\System32). |
ProcessAllowList | Applications expected to load DLLs from non-standard locations (e.g., development tools). |
TimeWindow | Correlation interval between DLL file creation, registry changes, and module load. |
HashBaseline | Baseline hashes for legitimate DLLs used to detect substitution. |