From 88 lines to 1: Detecting DLL hijacking with Elastic Defend

Elastic condenses 88 lines of detection logic into one Elastic Defend 9.5.0 rule catching the DLL hijacking used by a ClickFix campaign.

The ClickFix campaign side-loads a malicious mscoree.dll next to a signed Microsoft binary and also ships a driver to kill Elastic Endpoint. Elastic rebuilt the DLL as a NativeAOT library, dropped it beside the signed binary, and confirmed that Elastic Defend 9.5.0 flags the load. The post replaces 88 lines of detection logic with a single rule for DLL search-order hijacking.

• ClickFix campaign side-loads malicious mscoree.dll beside a signed Microsoft binary
• The campaign ships a driver to terminate Elastic Endpoint
• DLL rebuilt as a NativeAOT library; Elastic Defend 9.5.0 detected the load
• Detection logic reduced from 88 lines to a single rule