Windows DLL Hijacking
Background
This repo contains all scripts used to find relative path DLL Hijacking candidates on Windows 10 (version 1909), as described in this blog post.
Approach
The approach taken consists of two phases:
- The first phase is about identifying which DLLs may be vulnerable to hijacking;
- The second phase is about confirming which ones actually do.
Each phase is explained in more detail in the README files of their associated subfolders in this repo.
Used approach,taken from the blog post.
Contents
| Item | Description |
|---|---|
1_finding_candidates/ |
Files for Phase 1, which will result in a CSV file with all possible DLL hijack candidates. |
2_compiling_dlls/ |
Files for Phase 2, which will result in a set of files identifying confirmed DLL hijack candidates. |
dll_hijacking_candidates.csv |
A CSV file with all identified relative path DLL Hijacking candidates on Windows 10 (version 1909). |
possible_windows_dll_hijacking.yml |
Sigma rule identifying DLL loads of files in the list of DLL Hijack candidates from a folder other than their expected locations. |
REAMDE.md |
This file. |