COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-641

DLL Side-Loading

An adversary places a malicious version of a Dynamic-Link Library (DLL) in the Windows Side-by-Side (WinSxS) directory to trick the operating system into loading this malicious DLL instead of a legitimate DLL. Programs specify the location of the DLLs to load via the use of WinSxS manifests or DLL redirection and if they aren't used then Windows searches in a predefined set of directories to locate the file. If the applications improperly specify a required DLL or WinSxS manifests aren't explicit about the characteristics of the DLL to be loaded, they can be vulnerable to side-loading.

Soyutlama

Detailed

Tipik ciddiyet

High

Saldırı ihtimali

Low

Saldırıyı anla

Bu saldırı kalıbı nedir?

An adversary places a malicious version of a Dynamic-Link Library (DLL) in the Windows Side-by-Side (WinSxS) directory to trick the operating system into loading this malicious DLL instead of a legitimate DLL. Programs specify the location of the DLLs to load via the use of WinSxS manifests or DLL redirection and if they aren't used then Windows searches in a predefined set of directories to locate the file. If the applications improperly specify a required DLL or WinSxS manifests aren't explicit about the characteristics of the DLL to be loaded, they can be vulnerable to side-loading.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • The target must fail to verify the integrity of the DLL before using them.

Gerekli beceri

  • High: Trick the operating system in loading a malicious DLL instead of a legitimate DLL.

Gerekli kaynak

MITRE kaydında belirtilmemiş.

Etki

Başarılı saldırı neye yol açar?

Execute Unauthorized CommandsBypass Protection Mechanism

Etkilenen alanlar: Integrity

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Prevent unknown DLLs from loading through using an allowlist policy.
2
Patch installed applications as soon as new updates become available.
3
Properly restrict the location of the software being used.
4
Use of sxstrace.exe on Windows as well as manual inspection of the manifests.
5
Require code signing and avoid using relative paths for resources.
CAPEC-641: DLL Side-Loading — DayBreach Saldırı Sözlüğü · DayBreach