thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

DLL Side-Loading

Placing a malicious DLL alongside a legitimate signed application so the application loads it.

Definition

Applications that load DLLs by name without full paths will load the attacker's DLL from their own directory. Attackers ship a signed, trusted executable with the malicious DLL to evade detection. Monitoring for signed binaries running from unusual paths helps detect it.

Example

A legitimate signed antivirus updater copied to C:\ProgramData with a malicious version.dll beside it.

Exam tip

Side-loading abuses trust in signed executables; it is common in APT tradecraft.

Related terms