Sunday, May 4, 2025
HomeCyber Security NewsNew DLL Hijacking Technique Let Attackers Bypass Windows Security

New DLL Hijacking Technique Let Attackers Bypass Windows Security

Published on

SIEM as a Service

Follow Us on Google News

DLL hijacking is a technique where a malicious DLL (Dynamic Link Library) is placed in a directory that a vulnerable application searches before the legitimate one. 

When the application is launched, it unknowingly loads the malicious DLL instead, allowing attackers to:-

  • Execute arbitrary code
  • Compromise the system

Recently, the cybersecurity researchers at a multi-layered incident response company, Security Joes, discovered a new DLL hijacking technique that enables threat actors to bypass Windows mechanisms.

- Advertisement - Google News

New DLL Hijacking Technique

This new technique exploits trusted WinSxS executables using DLL Search Order Hijacking

This enables threat actors to execute malicious code within Windows folders, which eliminates the need for extra binaries. 

Besides this, it’s compatible with both Windows 10 and 11, as it bypasses high privilege requirements.

The DLL Search Order Hijacking exploits how Windows apps load DLLs, taking advantage of those without specified file paths. 

Threat actors manipulate apps depending on predefined search orders that place a malicious DLL in a prioritized directory. 

Many methods for this require apps not to specify full paths, often due to development oversights.

Knowing how Windows loads DLLs and executables is one of the key things, and the system follows a sequence during the loading process.

This ensures efficient operation by locating necessary components like DLLs. Not only that even, it also provides an alternative method for finding resources.

Besides this, the Windows OS flow for searching and loading resources includes the following things:-

  • Application’s launch directory
  • C:\Windows\System32
  • C:\Windows\System
  • C:\Windows
  • Current working directory
  • Directories in the system’s
  • User’s PATH variables

Exploiting the loading process lets threat actors inject unauthorized code into the trusted processes, which helps in deceiving the:-

  • Security tools
  • Security experts/analysts

This new malicious technique is completely sophisticated and stealthy as it enables threat actors to achieve several types of malicious goals like:-

  • Compromise systems
  • Evade detection

The WinSxS folder is a critical component in Windows OS at “C:\Windows\WinSxS.” This vital component crucially maintains multiple versions of system files. 

Not only that even, it also preserves previous versions during updates, which causes the folder to grow with each update for the Windows operating system.

Execution flow of the DLL Search Order Hijacking
Execution flow of the DLL Search Order Hijacking (Source – Security Joes)

Here below, we have mentioned all the key purposes of the WinSxS folder:-

  • Version Management
  • System Integrity
  • Dynamic Activation

Advantages New DLL hijacking technique

Here below, we have mentioned all the key advantages of this new DLL hijacking technique:-

  • Circumventing High Privilege Requirements
  • Eliminating the Need for Additional Binaries
  • Enhancing Stealth

PoC

Here below, we have mentioned the Proof-of-Concept video:-

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Claude AI Abused in Influence-as-a-Service Operations and Campaigns

Claude AI, developed by Anthropic, has been exploited by malicious actors in a range...

Threat Actors Attacking U.S. Citizens Via Social Engineering Attack

As Tax Day on April 15 approaches, a alarming cybersecurity threat has emerged targeting...

TerraStealer Strikes: Browser Credential & Sensitive‑Data Heists on the Rise

Insikt Group has uncovered two new malware families, TerraStealerV2 and TerraLogger, attributed to the...

MintsLoader Malware Uses Sandbox and Virtual Machine Evasion Techniques

MintsLoader, a malicious loader first observed in 2024, has emerged as a formidable tool...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Claude AI Abused in Influence-as-a-Service Operations and Campaigns

Claude AI, developed by Anthropic, has been exploited by malicious actors in a range...

Threat Actors Attacking U.S. Citizens Via Social Engineering Attack

As Tax Day on April 15 approaches, a alarming cybersecurity threat has emerged targeting...

TerraStealer Strikes: Browser Credential & Sensitive‑Data Heists on the Rise

Insikt Group has uncovered two new malware families, TerraStealerV2 and TerraLogger, attributed to the...