Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Detecting DLL Sideloading Attacks · mukul975 | DecimalAI

Detecting Dll Sideloading Attacks

SkillScore26Maintained

detecting-dll-sideloading-attacks

Detect DLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack execution flow for defense evasion.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/detecting-dll-sideloading-attacks/SKILL.md

decimalai skills pull detecting-dll-sideloading-attacks --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/detecting-dll-sideloading-attacks/SKILL.md https://app.decimal.ai/s/detecting-dll-sideloading-attacks/SKILL.md

Raw file: /s/detecting-dll-sideloading-attacks/SKILL.md ↗ · machine-readable summary at /s/detecting-dll-sideloading-attacks.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

Yes — +26% lift · at higher cost+30% tokens0% turns26% of whole cases pass with skill (6/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	—	—
case-03	✗→✓	▲ Improved	—	—
case-20	✗→✓	▲ Improved	—	—
case-16	✗→✓	▲ Improved	—	—
case-02	✗→✓	▲ Improved	—	—

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/detecting-dll-sideloading-attacks/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

assets/

SKILL.md

Detecting DLL Sideloading Attacks

When to Use

When investigating potential DLL hijacking in enterprise environments
After EDR alerts on unsigned DLLs loaded by signed applications
When hunting for APT persistence using legitimate application wrappers
During incident response to identify trojanized applications
When threat intel indicates DLL sideloading campaigns targeting specific software

Prerequisites

EDR with DLL load monitoring (CrowdStrike, MDE, SentinelOne)
Sysmon Event ID 7 (Image Loaded) with hash verification
Application whitelisting or DLL integrity monitoring
Software inventory of legitimate applications and expected DLL paths
Code signing verification capabilities

Workflow

Identify Sideloading Targets: Research known vulnerable applications that load DLLs without full path qualification (LOLBAS, DLL-sideload databases).
Monitor DLL Load Events: Query Sysmon Event ID 7 for DLL loads where the DLL path differs from the application's expected directory.
Check DLL Signatures: Flag unsigned or untrusted DLLs loaded by signed executables.
Detect Path Anomalies: Identify legitimate executables running from unusual locations (Temp, AppData, Public) that may be decoy wrappers.
Hash Verification: Compare loaded DLL hashes against known-good versions and threat intel feeds.
Correlate with Process Behavior: Check if the host process exhibits unusual behavior (network connections, child processes) after loading the suspicious DLL.
Document and Remediate: Report sideloading instances, quarantine malicious DLLs, and update detection rules.

Key Concepts

| Concept | Description | |---------|-------------| | T1574.002 | DLL Side-Loading | | T1574.001 | DLL Search Order Hijacking | | T1574.006 | Dynamic Linker Hijacking | | T1574.008 | Path Interception by Search Order Hijacking | | DLL Search Order | Windows DLL loading priority path | | Side-Loading | Placing malicious DLL where legitimate app loads it | | Phantom DLL | DLL that legitimate apps try to load but does not exist | | DLL Proxying | Malicious DLL forwarding calls to legitimate DLL |

Tools & Systems

| Tool | Purpose | |------|---------| | Sysmon | Event ID 7 DLL load monitoring | | CrowdStrike Falcon | DLL load detection with process context | | Microsoft Defender for Endpoint | DLL load anomaly detection | | Process Monitor | Real-time DLL load tracing | | DLL Export Viewer | Verify DLL export functions | | Sigcheck | Digital signature verification | | pe-sieve | PE analysis for proxied DLLs |

Common Scenarios

Legitimate App Wrapper: Adversary copies signed application (e.g., OneDrive updater) to temp folder alongside malicious DLL with same name as expected dependency.
Phantom DLL Exploitation: Malicious DLL placed in PATH location where legitimate app searches for non-existent DLL.
DLL Proxy Loading: Malicious version.dll proxies all exports to real version.dll while executing malicious code on DllMain.
Software Update Hijack: Attacker replaces DLL in update staging directory before legitimate updater loads it.

Output Format

Hunt ID: TH-SIDELOAD-[DATE]-[SEQ]
Technique: T1574.002
Host Application: [Legitimate signed executable]
Sideloaded DLL: [Malicious DLL name and path]
Expected DLL Path: [Where DLL should legitimately be]
DLL Signed: [Yes/No]
App Location: [Expected/Anomalous]
Host: [Hostname]
Risk Level: [Critical/High/Medium/Low]

Illustrative Want to see what detecting-dll-sideloading-attacks would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 01:52 UTC · 23 cases

Lift

+26%

26% vs 0%

Agent turns

1.0 vs 1.0

Tokens

+30%

2,030 vs 1,564.74

fail → pass · 6fail → fail · 17

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-21 To verify whether a suspected proxy DLL exports the exact function names expected by its host executable, which lightweight utility specifically inspects dynamic link library export tables?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We are investigating an incident where an adversary injected shellcode directly into an existing process memory space using VirtualAllocEx and WriteProcessMemory without writing any DLL files onto disk. Provide an incident response plan and log analysis strategy to detect this unbacked executable memory allocation.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 A threat actor dropped a vulnerable kernel driver gdrv.sys and used it to bypass Driver Signature Enforcement and disable EDR kernel callbacks via direct kernel object manipulation. Describe the procedure to detect and prevent BYOVD kernel driver exploitation.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We received an alert from our endpoint agent indicating that a signed system executable was executed from `C:\Users\Public\` and loaded an unsigned DLL named `helper.dll` in the same directory. I need you to analyze this potential sideloading incident and generate a formal threat hunt entry. The output must include the Hunt ID, MITRE technique ID, host application, details on the sideloaded DLL, expected DLL location, signature status of the library, whether the application path is anomalous or expected, target host name, and an overall risk level.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-22 Which specific MITRE ATT&CK sub-technique ID corresponds to Path Interception by Search Order Hijacking?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-23 Under the MITRE ATT&CK taxonomy, which sub-technique ID specifically designates Dynamic Linker Hijacking?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 Our threat hunting team is reviewing image load logs and flagged a signed utility executing from an unexpected directory while loading a local, untrusted library file instead of the system version. Analyze this suspicious load event and build a detection record containing the Hunt ID, technique tag, host application, sideloaded DLL details, expected standard DLL path, DLL signature status, application location assessment, target host, and determined risk level.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-09 An enterprise application attempts to load custom_ext.dll from its local folder upon startup, but that library is not natively installed on Windows. If an attacker places a malicious payload with that name in a folder listed in the system PATH variable, what specific category of DLL hijacking is being executed?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 An adversary places an unsigned payload DLL into the same directory as a legitimately signed executable, causing the binary to execute the payload automatically upon launch. Which specific MITRE ATT&CK sub-technique ID represents this DLL Side-Loading activity?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 After confirming that a signed executable loaded an untrusted dependency DLL, what subsequent host behaviors should an investigator verify in step 6 of the investigation workflow to determine if active command and control was established?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 An adversary copies a signed system executable to C:\Users\Public\Downloads\ along with a malicious DLL file. What specific check in the sideloading investigation workflow alerts responders to this decoy binary setup?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 An attacker drops a malicious library into an application's update staging directory immediately before the updater process executes. Which common DLL exploitation scenario describes this tactic?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-16 An endpoint alert flagged an event on host SEC-LAPTOP-01 where calc.exe loaded custom.dll. Digital signature analysis reveals that custom.dll lacks any code signature. In the standardized threat hunt report schema, what exact value must be entered for the DLL Signed field?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-05 An analyst detected a suspicious process on an Ubuntu server where /etc/ld.so.preload was modified to load /lib/x86_64-linux-gnu/malicious.so for all newly spawned processes. Explain how to audit and remediate this Linux environment variable dynamic library preloading persistence mechanism.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 When an application relies on standard Windows search order priority and loads a rogue DLL located earlier in the search path before checking system directories, which specific MITRE ATT&CK sub-technique ID classifies this technique?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 During incident response on endpoint 'FIN-SRV-04', we discovered a legitimate OneDrive updater running out of `C:\Users\jsmith\AppData\Local\Temp\` that pulled in a suspicious `propsys.dll`. Please evaluate this behavior for DLL hijacking or sideloading persistence. Summarize your findings providing the Hunt ID, associated MITRE technique, host application executable, sideloaded DLL name and path, expected legitimate DLL path, whether the DLL is signed, app location status, hostname, and evaluated risk level.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-07 When configuring Windows endpoint logging to track dynamic link library load events across enterprise workstations for search order anomalies, which specific Sysmon Event ID must be enabled to record image loads?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 An attacker places a malicious library file named version.dll alongside a legitimate binary. When called, the malicious DLL executes arbitrary code inside DllMain while forwarding all valid exported function calls to the real version.dll in System32. What specific technical term describes this redirection strategy?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 An incident responder needs a command-line tool from the Sysinternals suite to verify digital signatures and certificate trust status for suspicious executables and DLLs found on an endpoint. Which utility should be specified?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 An analyst suspects that an in-memory library is performing DLL proxying and unbacked export forwarding. Which specialized PE analysis tool designed to scan running processes and detect modified PE headers should be utilized?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 When auditing an application inside a sandbox to identify non-existent or unqualified DLL calls made during binary launch, which Sysinternals tool provides real-time file system load tracing?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 A signed binary workapp.exe running from C:\ProgramData\Vendor\ loaded an unsigned netutils.dll located in that same folder. When creating a threat hunt record using the standardized key-value format, what explicit value must be assigned to the App Location field?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-17 What are the allowed severity levels for the Risk Level entry when filling out a formal threat hunt report for a sideloading detection?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +26 percentage points is the difference between those two pass rates over the 23 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 0%
Pass rate with the skill: 26.1%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 01:52 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run26

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.