T1574.001 — DLL

Tactics: Stealth, Execution · Platforms: Windows

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused…

Sub-technique of Hijack Execution Flow (T1574).

Sigma detection rules (1)

T1574.001 Hijack Execution Flow: DLL

title: "T1574.001 Hijack Execution Flow: DLL"
id: d0e06b36-c1db-432c-b260-7e7b7eb6a436
description: 'Detection Strategy for Hijack Execution Flow for DLLs. (Retargeted from the original process_creation label to file_event — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: AllowedDllPaths, ProcessAllowList, TimeWindow, HashBaseline.'
references:
  - https://attack.mitre.org/techniques/T1574/001
author: Shahrukh Khan
date: 2026-03-20
license: MIT
tags:
  - attack.stealth
  - attack.execution
  - attack.t1574.001

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    TargetFilename|endswith:
      - '\version.dll'
      - '\dbghelp.dll'
      - '\winmm.dll'
      - '\uxtheme.dll'

  filter_correct_path:
    TargetFilename|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'

  condition: selection and not filter_correct_path

falsepositives:
  - Rare — legitimate software should not drop copies of these well-known hijackable system DLL names outside the actual system directories; verify signature and hash of any match.

level: high

Related sub-techniques

Explore