Lateral Movement — SCM and DLL Hijacking Primer

This report analyzes two Windows service DLL hijacks—IKEEXT (wlbsctrl.dll) and SessionEnv (TSMSISrv.dll/TSVIPSrv.dll)—that enable lateral movement by placing malicious DLLs in System32 and restarting services via the Service Control Manager; it details discovery using Procmon and reverse engineering, references proof-of-concept code, and outlines host- and network-based detections and mitigations (e.g., service auditing, Exploit Guard Event ID 11, and RPC/SMB SVCCTL telemetry).