Windows 10 Executables Vulnerable to DLL Hijacking

Summary

Security researcher Wietze Beukema discovered almost 300 Windows 10 executables that are vulnerable to DLL hijacking. A threat actor can enable a legitimate Windows executable to load an arbitrary DLL with malicious intent using a simple VBScript to gain administrative privileges and bypass user access controls (UAC).  These attacks have the potential to allow threat actors to execute arbitrary code, escalate privileges, and gain persistence on the target system.

Recommendations

The NJCCIC recommends utilizing Beukema's detection and prevention techniques, such as monitoring for suspicious activity in the Windows folders, adjusting UAC settings to "always notify," and identifying any instance of DLL creation and loading from unexpected file paths. Developers are advised to use absolute paths instead of relative ones for loading DLLs. More technical information can be found in Wietze Beukema's blog post and the Bleeping Computer article.