Skip to content

v1.0.0 - Initial Release

Choose a tag to compare

View all tags
@projectmerai projectmerai released this 02 Mar 14:33
· 41 commits to main since this release
v1.0.0
10126e0

DLLHijackHunter v1.0.0

Automated DLL Hijacking Detection with Zero False Positives

Highlights

  • 50+ DLL hijacking vulnerabilities discovered across enterprise security software in first scan
  • Canary confirmation — proves hijacks actually work before reporting
  • 8-gate filter pipeline — eliminates false positives
  • ETW real-time monitoring — catches runtime-loaded DLLs
  • 5-tier scoring — Confirmed > High > Medium > Low > Info

Features

  • 10 hijack types: Phantom, Search Order, Side-Loading, .local Redirect, ENV PATH, KnownDLL Bypass, CWD, AppInit, IFEO, AppCert
  • 6 discovery sources: Services, Scheduled Tasks, Startup Items, COM Objects, Run Keys, ETW
  • 4 scan profiles: Aggressive, Strict, Safe, Red Team
  • 3 output formats: Console, JSON, HTML
  • Target filtering: Scan specific binaries, directories, or filenames with --target

Quick Start

.\DLLHijackHunter.exe --profile aggressive

Requirements

  • Windows 10/11 or Windows Server 2016+
  • Administrator privileges recommended (required for ETW, canary, service triggers)
  • Self-contained binary — no .NET runtime needed

Assets

  • DLLHijackHunter.exe — Self-contained Windows x64 binary
Assets 3
Loading