In our opinion, however, those tools are not sufficient. So, is there a cure for DLL hijacking? There are multiple tools that claim to detect applications vulnerable to DLL hijacking. DLL hijacking, on the other hand, can be extremely useful in those cases, since the bad guy only needs to write malicious payload into a specific path for the vulnerable (whitelisted) application to happily load their code. Traditional code injection methods often include opening a handle to a remote process, which is a noisy activity that could cause an alert. Many endpoint security products are based on whitelisting signed applications, making attackers’ lives difficult when they try to run unsigned code.

Most of the time, an attacker uses DLL hijacking in order to gain code injection into a digitally signed application. This attack method has been in use since the beginning of Windows 2000 and is still alive and kicking. In other words, simply putting a DLL file in the right place causes a vulnerable application to load that malicious DLL. DLL hijacking is an attack that exploits the Windows search and load algorithm, allowing an attacker to inject code into an application through disk manipulation.

What is a dll file?