Lion Cipher Lab

Characterize DLL sideloading: a signed app tricked into loading a malicious DLL

• Digital Forensics & IR (DFIR)
• Advanced
• ~55 min
• Free · no account required

Why it matters

Application allow-listing — 'only let signed, trusted software run' — is one of the strongest controls a defender has. DLL side-loading is how attackers walk straight through it. They don't write a suspicious new EXE that a scanner or allow-list would stop; they take a REAL, correctly signed program from a legitimate vendor, drop it into a folder they can write to, and place a malicious DLL right next to it under a name that program loads. Because of the way Windows finds DLLs, the trusted signed program loads the attacker's DLL from its own folder — and now the malicious code is running…

What you'll learn

• reading the relationship between an executable and the DLLs it imports by name
• understanding the Windows DLL search order and why an app's own folder is searched before System32
• recognising the side-loading / DLL-proxy pattern: a legitimate signed EXE + a malicious neighbour DLL it will load
• verifying Authenticode signatures on both an EXE and a DLL, and reading the result (Valid / NotSigned)
• using the signature + timestamp MISMATCH (old signed exe, fresh unsigned DLL) as the decisive tell
• reading Sysmon Event ID 7 (Image Loaded) to see which module loaded from where, and whether it was signed
• explaining why malicious code loaded this way inherits the signed process's trust and defeats application allow-listing
• distinguishing malicious sideloading from a legitimate application loading its own plugin
• mapping the behaviour to MITRE ATT&CK T1574.001 (Hijack Execution Flow: DLL), and recognising the retired T1574.002 (DLL Side-Loading) label in older reports
• judgment: when the collected artifacts characterize sideloading and when they don't, and how a pro closes the gap

Steps in this lab

1. The scene: a trusted vendor tool in a folder it has no business being in
2. Artifact 1 — the directory listing: a 2021 signed exe next to a DLL made yesterday
3. How Windows finds a DLL — and why the app's own folder wins
4. Artifact 2 — the import table: helper.exe asks for logutil.dll BY NAME
5. Artifact 3 — the signature check: Valid exe, UNSIGNED DLL (the tell)
6. Artifact 4 — the module-load events: the signed exe loading the unsigned neighbour, not System32
7. Artifact 5 — the payoff: malicious behaviour running under the TRUSTED process
8. Name it precisely: T1574.001 (DLL) — and the variant you are looking at
9. WHEN the artifacts characterize sideloading — and when it's just a plugin (the judgment)
10. How a pro verifies and fixes it — and why the fix is trusted absolute paths

Open the full interactive lab →