10 Years of DLL Hijacking, and What We Can Do to Prevent 10 More

This write-up reviews DLL hijacking (aka DLL sideloading) as a long-standing TTP, clarifying definitions, common attacker goals (evasion, persistence, privilege escalation), and patterns seen across many campaigns (notably bundling a benign executable with a malicious DLL, frequent abuse of trusted vendor and Windows binaries). It outlines practical hunting/detection methods (e.g., ProcMon NAME NOT FOUND events, EDR telemetry for unsigned or mismatched DLLs, and hijacklibs intelligence), highlights technical traits of malicious DLLs (packed/obfuscated payloads, export redirection/stubs, subtle export-name typos), and provides developer-focused mitigations (constraining search paths with SetDllDirectory/Safe Search Mode, using fully qualified paths, and enforcing digital signatures), including a Rust-based PoC for self-signed verification. The conclusion stresses that while practical defenses reduce risk, only broad, enforced signature verification would largely eliminate this class of attacks, so defenders should avoid over-reliance on process reputation and focus on behavior.