Article Demonstrates Windows LOLBin Techniques for DLL Reverse-Shell Execution
Summary
The article demonstrates how Windows LOLBins can load a reverse-shell DLL, including process injection with mavinject.exe, and outlines detection ideas and mitigations such as application controls, egress filtering, and privilege limits.
Key points
- The walkthrough uses msfvenom to create a 64-bit Windows reverse-TCP DLL and a netcat listener to receive the shell.
- It demonstrates DLL execution through msiexec, rundll32, netsh, Register-CimProvider, regsvr32, and control.exe.
- The mavinject.exe example injects a DLL into a running process; injecting into processes owned by other users or SYSTEM requires SeDebugPrivilege.
- The techniques use trusted Windows binaries to load DLLs, which can make their activity less conspicuous to security tools.
- Recommended detection includes monitoring unexpected outbound connections from these binaries and DLL loads from user-writable directories.
- Suggested defenses include AppLocker or WDAC, egress filtering, command-line auditing, Defender ASR rules, and limiting SeDebugPrivilege.
Article Details
- Topic
- Windows DLL execution and process injection techniques using LOLBins
MITRE ATT&CK
T1055.001 · Dynamic-link Library InjectionThe article maps mavinject DLL injection into a running process to Process Injection: Dynamic-link Library Injection.T1218 · System Binary Proxy ExecutionThe article maps using register-cimprovider to load a DLL to Signed Binary Proxy Execution.T1218.002 · Control PanelThe article maps loading a DLL through control.exe to Signed Binary Proxy Execution: Control Panel.T1218.007 · MsiexecThe article maps msiexec DLL loading through the /y flag to Signed Binary Proxy Execution: Msiexec.T1218.010 · Regsvr32The article maps silent DLL execution with regsvr32 to Signed Binary Proxy Execution: Regsvr32.T1218.011 · Rundll32The article maps using rundll32 to load a DLL to Signed Binary Proxy Execution: Rundll32.T1546.007 · Netsh Helper DLLThe article maps loading a DLL as a netsh helper to Event Triggered Execution: Netsh Helper DLL.