Technique Search Instance

HTTP 200 OK
Allow: GET, PUT, PATCH, DELETE, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "id": 219,
    "key": "dll-proxying",
    "unprotect_id": "U1240",
    "name": "DLL Proxying",
    "description": "DLL proxying is a technique used by malware to evade detection and gain persistence on a system. It involves replacing a legitimate DLL with a malicious DLL that has the same exported functions and is named similarly to the legitimate DLL. \r\n\r\nWhen a program attempts to load the legitimate DLL, it will instead load the malicious DLL, which acts as a proxy for the legitimate DLL. The malicious DLL will redirect function calls to the legitimate DLL, allowing the malware to execute its own code and perform malicious actions without the program realizing that it is not the legitimate DLL. \r\n\r\nThis technique allows the malware to operate stealthily and evade detection by security software, as the malicious DLL is designed to mimic the legitimate DLL. This makes it difficult for security software to differentiate between the legitimate and malicious DLLs, allowing the malware to continue to operate undetected.",
    "resources": "https://www.ired.team/offensive-security/persistence/dll-proxying-for-persistence\nhttps://itm4n.github.io/dll-proxying/\nhttps://github.com/Sh0ckFR/DLLirant",
    "creation_date": "2022-07-25T09:10:00.495000Z",
    "tags": "DLL proxying,\r\nCode obfuscation,\r\nPersistence,\r\nDLL redirection,\r\nStealth operation,",
    "modification_date": "2023-10-04T10:43:33.827000Z",
    "category": [
        4
    ],
    "rules": [
        124
    ],
    "attachments": [],
    "featured_api": [],
    "contributors": [
        21
    ]
}