Windows DLL Search Order Hijacking via Additional Space in DLL Path

title: Windows DLL Search Order Hijacking via Additional Space in DLL Path
id: 4a424941-afe1-4d2e-8d1a-6456e2d4a1aa
status: test
description: This rule flags file creation or access events where a DLL path includes Windows system directory names with an added trailing space (for example, "C:\Windows " or "C:\Program Files ") and the target filename ends with .dll. Attackers can use this subtle path manipulation to influence DLL loading behavior and redirect execution to a malicious library. The detection relies on Windows file event telemetry containing the full target filename string.
references:
  - https://twitter.com/cyb3rops/status/1552932770464292864
  - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_dll_sideloading_space_path.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-30
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|startswith:
      - C:\Windows \
      - C:\Program Files \
      - C:\Program Files (x86) \
    TargetFilename|endswith: .dll
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b6f91281-20aa-446a-b986-38a92813a18f
    type: derived