MITRE ATT&CK detection coverage

← Back to main site

Home/ MITRE Matrix/ Defense Evasion/ T1574.001

T1574.001DLL

T1574.001 — DLL is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 20 detection use cases covering it and 3 threat-intel articles citing it.

Defense EvasionExecution

View on the matrix → Filter Detection Library MITRE official spec ↗

20Use cases

3Articles

0Sub-techniques

2Tactics

↑ Parent technique: T1574 · Hijack Execution Flow

Use cases covering this technique (20)

MSI Module Loaded by Non-System Binary ESCU actions · hunting P Msmpeng Application DLL Side Loading ESCU actions · alerting P Windows DLL Search Order Hijacking Hunt with Sysmon ESCU actions · hunting P Windows DLL Search Order Hijacking with iscsicpl ESCU actions · alerting P Windows DLL Side-Loading In Calc ESCU actions · alerting P Windows DLL Side-Loading Process Child Of Calc ESCU actions · hunting P Windows Hijack Execution Flow Version Dll Side Load ESCU actions · hunting P Windows Known Abused DLL Created ESCU actions · hunting P Windows Known Abused DLL Loaded Suspiciously ESCU actions · alerting P Windows Known GraphicalProton Loaded Modules ESCU actions · hunting P Windows Masquerading Explorer As Child Process ESCU actions · alerting P Windows Mustang Panda USB Tool Execution ESCU actions · alerting P Windows SqlWriter SQLDumper DLL Sideload ESCU actions · alerting P Windows Unsigned DLL Side-Loading ESCU actions · hunting P Windows Unsigned DLL Side-Loading In Same Process Path ESCU actions · alerting P Windows Unsigned MS DLL Side-Loading ESCU actions · hunting P Windows DLL Search Order Hijacking Hunt ESCU actions · hunting P [LLM] NightLedger DLL side-load: AppVShNotify.exe loading SspiCli.dll from non-System32 Bespoke install · alerting DSΣPDDCS [LLM] NightLedger DLL search-order hijack: SspiCli.dll side-loaded by AppVShNotify.exe Bespoke install · alerting DSΣPDDCS [LLM] CAV3RN framework module DLLs loaded/dropped (AzureCommunication / n-HTCommp / masqueraded uxtheme) Bespoke install · hunting DSΣPDDCS

Articles citing this technique (3)

crit Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays art-57

crit Mirage Kitten targets Middle East and Africa region with new malware art-61

high New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery art-136