CmdID

CmdID / Techniques / T1574

T1574.001 Hijack Execution Flow: DLL

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. MITRE ATT&CK

2 programs on CmdID 15 Sigma rules T1574.001 on attack.mitre.org

Part of

MITRE ATT&CK
T1574Hijack Execution Flow

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
dnscmd.exeits Sigma rulesxwizard.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first
criticalAPT27 - Emissary Panda ActivityFlorian Roth (Nextron Systems) · Windows
criticalWinnti Malware HK University CampaignFlorian Roth (Nextron Systems), Markus Neis · Windows
criticalWinnti Pipemon CharacteristicsFlorian Roth (Nextron Systems), oscd.community · Windows
highDLL Sideloading by VMware Xfer UtilityNasreddine Bencherchali (Nextron Systems) · Windows
highNew DNS ServerLevelPluginDll Installed Via Dnscmd.EXEFlorian Roth (Nextron Systems) · Windows
highPingback Backdoor ActivityBhabesh Raj · Windows
highPotential Mpclient.DLL Sideloading Via Defender BinariesBhabesh Raj · Windows
highPotential PlugX ActivityFlorian Roth (Nextron Systems) · Windows
highRenamed Vmnat.exe Executionelhoim · Windows
highSmall Sieve Malware CommandLine IndicatorNasreddine Bencherchali (Nextron Systems) · Windows
highSuspicious GUP UsageFlorian Roth (Nextron Systems) · Windows
highTasks Folder EvasionSreeman · Windows
highXwizard.EXE Execution From Non-Default LocationChristian Burkard (Nextron Systems) · Windows
mediumPotential DLL Sideloading Via DeviceEnroller.EXE@gott_cyber · Windows
mediumPotentially Suspicious Child Process of KeyScrambler.exeSwachchhanda Shrawan Poudel · Windows