npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
- When investigating potential DLL hijacking in enterprise environments
Detects DLL side-loading attacks via Sysmon Event ID 7 monitoring, signature verification, path anomaly checks, and process correlation for threat hunting in Windows environments.
Detects DLL side-loading attacks (T1574.002) via Sysmon event ID 7 monitoring, DLL signature checks, hash validation, and process behavior correlation. For Windows threat hunting with EDR.
Proactively hunts for adversary abuse of LOLBins (legitimate system binaries like certutil, mshta) in EDR/SIEM logs to detect evasion tactics.
Share bugs, ideas, or general feedback.
| Concept | Description |
|---|---|
| T1574.002 | DLL Side-Loading |
| T1574.001 | DLL Search Order Hijacking |
| T1574.006 | Dynamic Linker Hijacking |
| T1574.008 | Path Interception by Search Order Hijacking |
| DLL Search Order | Windows DLL loading priority path |
| Side-Loading | Placing malicious DLL where legitimate app loads it |
| Phantom DLL | DLL that legitimate apps try to load but does not exist |
| DLL Proxying | Malicious DLL forwarding calls to legitimate DLL |
| Tool | Purpose |
|---|---|
| Sysmon | Event ID 7 DLL load monitoring |
| CrowdStrike Falcon | DLL load detection with process context |
| Microsoft Defender for Endpoint | DLL load anomaly detection |
| Process Monitor | Real-time DLL load tracing |
| DLL Export Viewer | Verify DLL export functions |
| Sigcheck | Digital signature verification |
| pe-sieve | PE analysis for proxied DLLs |
Hunt ID: TH-SIDELOAD-[DATE]-[SEQ]
Technique: T1574.002
Host Application: [Legitimate signed executable]
Sideloaded DLL: [Malicious DLL name and path]
Expected DLL Path: [Where DLL should legitimately be]
DLL Signed: [Yes/No]
App Location: [Expected/Anomalous]
Host: [Hostname]
Risk Level: [Critical/High/Medium/Low]