value:  A FinFisher variant uses DLL search order hijacking. ;; Hikit has used DLL Search Order Hijacking to load oci.dll as a persistence mechanism. ;; HTTPBrowser abuses the Windows DLL load order by using a legitimate Symantec anti-virus binary VPDN_LU.exe to load a malicious DLL that mimics a legitimate Symantec DLL navlu.dll. ;; InvisiMole can be launched by using DLL search order hijacking in which the wrapper DLL is placed in the same folder as explorer.exe and loaded during startup into the Windows Explorer process instead of the legitimate library. ;; Melcoz can use DLL hijacking to bypass security controls. ;; menuPass has used DLL search order hijacking. ;; MirageFox is likely loaded via DLL hijacking into a legitimate McAfee binary. ;; PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes. ;; Prikormka uses DLL search order hijacking for persistence by saving itself as ntshrui.dll to the Windows directory so it will load before the legitimate ntshrui.dll saved in the System32 subdirectory. ;; Ramsay can hijack outdated Windows application dependencies with malicious versions of its own DLL payload. ;; RedLeaves is launched through use of DLL search order hijacking to load a malicious dll. ;; RTM has used search order hijacking to force TeamViewer to load a malicious DLL. ;; Threat Group-3390 has performed DLL search order hijacking to execute their payload. ;; Variants of WEBC2 achieve persistence by using DLL search order hijacking usually by copying the DLL file to %SYSTEMROOT% (C:\WINDOWS\ntshrui.dll). ;; Whitefly has used search order hijacking to run the loader Vcrodat.
name: Hijack Execution Flow: Dll Search Order Hijacking