From 88 lines to 1: Detecting DLL hijacking with Elastic Defend
Elastic condenses 88 lines of detection logic into one Elastic Defend 9.5.0 rule catching the DLL hijacking used by a ClickFix campaign.
The ClickFix campaign side-loads a malicious mscoree.dll next to a signed Microsoft binary and also ships a driver to kill Elastic Endpoint. Elastic rebuilt the DLL as a NativeAOT library, dropped it beside the signed binary, and confirmed that Elastic Defend 9.5.0 flags the load. The post replaces 88 lines of detection logic with a single rule for DLL search-order hijacking.
- ClickFix campaign side-loads malicious mscoree.dll beside a signed Microsoft binary
- The campaign ships a driver to terminate Elastic Endpoint
- DLL rebuilt as a NativeAOT library; Elastic Defend 9.5.0 detected the load
- Detection logic reduced from 88 lines to a single rule
- ATT&CK
- T1574.002 DLL Side-LoadingT1574.001 DLL Search Order HijackingT1562.001 Disable or Modify Tools
- Products
- Elastic Defendmscoree.dll
- Threat actors
- ClickFix
From the original article
The ClickFix campaign that sideloads a malicious mscoree. dll also ships a driver to kill Elastic Endpoint. We rebuilt that DLL as a NativeAOT library, dropped it beside a signed Microsoft binary, and Elastic Defend 9.
By Ian Garratt,Tamás Péter · elastic.co
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.