All About DLL Hijacking - My Favorite Persistence Method
00:00 - Intro 00:25 - Why DLL Hijack is my favorite persistence, talk about a few others 02:03 - Going over the source code to our sample applications to talk about DLL Hijacking 03:20 - Compiling our executable and dll then transfering it to our windows box 04:50 - Using Process Monitor to show standard DLL Hijacking (when a DLL Does not exist) 06:10 - Showing the order windows tries to load the DLL (Directory of binary then PATH) 07:20 - Talking about a somewhat common mistake when people make edits to the PATH (ex: Java/Python/etc) 09:00 - Placing the DLL test.exe is looking for and achieving code execution 11:25 - Showing if we can write in c:\Windows, we can hijack most dll's explorer.exe loads from system32. 14:00 - Messing up using Process Monitor for a bit, sorry should have prepped a bit more 15:30 - Showing why explorer is unique, then putting CSCAPI.DLL into c:\Windows\... This would get ran anytime a user logs into the system 17:55 - DLL Hijacking OneDrive for user level persistence 19:30 - Wrapping up, talking about some videos where I talk more about creating DLL's which can help with this
DIY C2 - Malleable Agent Config
are built-in windows programs vulnerable?
CppCon 2017: James McNellis “Everything You Ever Wanted to Know about DLLs”
UHC - Ransom
AV Evasion - Mimikatz
Deep Dive into DLL Sideloading and DLL Hijacking - Malware Development Course
Executing Linux Binaries Without Touching Disk - Living Off The Land with DDExec and Dirty Pipe Demo
Monitoring Sensitive Windows Commands via CanaryTokens - Deploying Registry Entries via Group Policy
PowerSIEM - Analyzing Sysmon Events with PowerShell - Dynamic Malware Analysis
The Most Mysterious File On The Internet
Something is jamming GPS over Europe. Here's what we found
Practical Malware Analysis Essentials for Incident Responders
HackTheBox - Nocturnal
Develop Your Own RAT: EDR + AV Defense by Dobin Rutishauser
The AI Take Over Has Completely Backfired and I Can't Be Happier
DLL Hijacking
Process Injection Techniques - Gotta Catch Them All
How Hackers Evade Program Allowlists with DLLs
Top 5 Wireshark tricks to troubleshoot SLOW networks
