Context Blog DLL Search Order Hijacking

In this article we discuss the fundamentals of DLL Search Order and how Context's Intelligence and Response teams have seen this mechanism being abused as a means of conducting network intrusions in real environments. We provide examples on how legitimate binaries can be weaponized and introduce a tool to automate the discovery of binaries suitable for payload execution via DLL hijacking.