DLL Search Order Hijacking

Windows DLL search-order hijacking occurs when an adversary can place an unintended DLL in a directory the applicable loader search checks before resolving the requested module, causing the application to load it. The DLL's code then runs in the host process security context; privilege escalation depends on the host process actually running with higher privileges. ATT&CK T1574.001 also groups DLL side-loading, redirection, phantom DLL hijacking, DLL substitution, and remote DLL hijacking. Search behavior varies with the packaged or unpackaged application model, loaded modules, Known DLLs, package dependencies, manifests, search flags, and Windows version; a DLL beside an executable or outside a system directory alone does not prove hijacking.