MITRE ATT&CK / T1073
T1073
DLL Side-Loading
Description
Programs may specify DLLs that are loaded at runtime. Programs that improperly or vaguely specify a required DLL may be open to a vulnerability in which an unintended DLL is loaded. Side-loading vulnerabilities specifically occur when Windows Side-by-Side (WinSxS) manifests (Citation: MSDN Manifests) are not explicit enough about characteristics of the DLL to be loaded. Adversaries may take advantage of a legitimate program that is vulnerable to side-loading to load a malicious DLL. (Citation: Stewart 2014)Adversaries likely use this technique as a means of masking actions they perform under a legitimate, trusted system or software process.
Platforms
Use our free MITRE ATT&CK lookup tool, or browse the full ATT&CK matrix.
Our coverage
- Screening Serpens: Iranian APT Fuses AppDomainManager Hijacking with New RATs in 2026 Espionage Campaign
- TCLBANKER Banking Trojan Spreads via WhatsApp and Outlook Worm Modules
- UAT-8302 China APT Malware Analysis: Shared Implants, IOCs, and Detection Rules
Source: MITRE ATT&CK Enterprise matrix. View on attack.mitre.org →