Detecting DLL Hijacking for Privilege Escalation: Phantom DLLs and Writable Paths

Windows resolves a DLL by walking a defined search order, and some elevated processes request libraries that do not exist on disk or look first in a directory ordinary users can write (T1574.001). Dropping a DLL there yields code execution at the process’s privilege level. The attacker’s write and the victim’s load are both observable, and the pair is the best detection.

Signals at a Glance

The Load Event

Image-load telemetry is voluminous, so constrain it to the interesting case: a SYSTEM process loading from a user-writable location. Joining to the earlier file write gives you the planted-and-loaded sequence:

// Microsoft Defender (KQL) - SYSTEM process loading a DLL from user-writable paths
DeviceImageLoadEvents
| where InitiatingProcessAccountSid == "S-1-5-18"
| where FileName endswith ".dll"
| where FolderPath startswith @"C:\Users" or FolderPath startswith @"C:\ProgramData"
     or FolderPath has "Temp"
| join kind=leftouter (
    DeviceFileEvents
    | where ActionType == "FileCreated" and FileName endswith ".dll"
    | project CreatedAt=Timestamp, DeviceId, FolderPath, FileName, CreatorSid=InitiatingProcessAccountSid
  ) on DeviceId, FolderPath, FileName
| project Timestamp, DeviceName, InitiatingProcessFileName, FolderPath, FileName, SHA256, CreatedAt, CreatorSid
// tune/validate: legitimate software under ProgramData loads its own DLLs; allowlist by signer.

Finding Hijackable Loads Before Attackers Do

The same logic works as a Sigma rule on Sysmon Event 7, and as a proactive audit. In a lab, Process Monitor filtered to Result is NAME NOT FOUND, Path ends with .dll, and the user set to SYSTEM lists the phantom DLL candidates; any whose parent directory is writable is a finding:

title: Elevated Process Loads Unsigned DLL from Writable Path
logsource:
  product: windows
  category: image_load
detection:
  selection:
    User: 'NT AUTHORITY\SYSTEM'
    Signed: 'false'
    ImageLoaded|contains:
      - '\Users\'
      - '\ProgramData\'
      - '\Temp\'
  condition: selection
level: medium
# tune/validate: requires Sysmon image-load logging, which is high volume; scope by user and path.

• Known phantom DLL cases, such as wlbsctrl.dll loaded by the IKE and AuthIP service on some builds, are documented in the community; check that your builds do not search writable locations for them.
• Prefer fixing ACLs on service directories and enabling safe DLL search mode over trying to blocklist DLL names.
• Application control such as WDAC or AppLocker in audit mode shows which unsigned DLLs elevated processes load, and gives you an allowlist to enforce later.