Reconstructing and Detecting Windows DLL Search-Order Hijack...

[carlospolop]

Blog URL

https://elastic.co/security-labs/threat-command/dll-search-order-hijacking-elastic-defend

Blog Title

Reconstructing and Detecting Windows DLL Search-Order Hijacking with Elastic Defend 9.5.0

Blog high summary

DLL search-order hijacking abuses Windows loader behavior: a malicious same-name DLL placed beside a signed executable loads before the legitimate System32 copy. The post reconstructs the August 2026 ErrTraffic/Cruciferra chain using vb7to8.exe, a NativeAOT .NET 7 mscoree.dll, ServiceModelReg.exe process hollowing, and BYOVD EDR disabling. It includes a benign message-box PoC and shows how Elastic Defend

9.5.0 detects the behavior with dll.Ext.defense_evasions: "DLL Hijack: Masquerading".

PR changes

• src/windows-hardening/windows-local-privilege-escalation/dll-hijacking/README.md: Added or revised coverage of NativeAOT DLL with export-triggered initialization; Detection: DLL masquerading library loads.

Errors

mdbook build unavailable

[carlospolop]

merge

[carlospolop]

Conflict repair: resolved
Head: fa208348bc230372767f920486ce5200628e9dd3

Merged the PR’s NativeAOT DLL and version-scoped detection documentation with the default branch’s custom-loader and PE import-grafting coverage.

• All inventoried conflict markers were removed.
• Both variants’ substantive lines and complete fenced examples were preserved.
• References were reconciled into a continuous 1–32 sequence, with default-branch citations renumbered to 31–32.
• Relative links, reference targets, structural delimiters, SUMMARY discoverability, and whitespace were checked; no mdBook build was run.
• Added a legacy UAC heading alias required by an existing link from the resolved page.