Skip to content
master
Go to file
Code

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 
 
 
 
 

README.md

Windows DLL Hijacking

Background

This repo contains all scripts used to find relative path DLL Hijacking candidates on Windows 10 (version 1909), as described in this blog post.

Approach

The approach taken consists of two phases:

  1. The first phase is about identifying which DLLs may be vulnerable to hijacking;
  2. The second phase is about confirming which ones actually do.

Each phase is explained in more detail in the README files of their associated subfolders in this repo.

Used approach, taken from the blog post.

Used approach,taken from the blog post.

Contents

Item Description
1_finding_candidates/ Files for Phase 1, which will result in a CSV file with all possible DLL hijack candidates.
2_compiling_dlls/ Files for Phase 2, which will result in a set of files identifying confirmed DLL hijack candidates.
dll_hijacking_candidates.csv A CSV file with all identified relative path DLL Hijacking candidates on Windows 10 (version 1909).
possible_windows_dll_hijacking.yml Sigma rule identifying DLL loads of files in the list of DLL Hijack candidates from a folder other than their expected locations.
REAMDE.md This file.

About

Project for identifying executables and DLLs vulnerable to relative path DLL hijacking.

Resources

License

Releases

No releases published
You can’t perform that action at this time.