Home

Awesome

Windows DLL Hijacking

Background

This repo contains all scripts used to find relative path DLL Hijacking candidates on Windows 10 (version 1909), as described in this blog post.

Approach

The approach taken consists of two phases:

  1. The first phase is about identifying which DLLs may be vulnerable to hijacking;
  2. The second phase is about confirming which ones actually do.

Each phase is explained in more detail in the README files of their associated subfolders in this repo.

Used approach, taken from the blog post.

Used approach,taken from the blog post.

Contents

ItemDescription
1_finding_candidates/Files for Phase 1, which will result in a CSV file with all possible DLL hijack candidates.
2_compiling_dlls/Files for Phase 2, which will result in a set of files identifying confirmed DLL hijack candidates.
dll_hijacking_candidates.csvA CSV file with all identified relative path DLL Hijacking candidates on Windows 10 (version 1909).
possible_windows_dll_hijacking.ymlSigma rule identifying DLL loads of files in the list of DLL Hijack candidates from a folder other than their expected locations.
REAMDE.mdThis file.