DLL hijacking: the library loaded from the wrong place

When a program loads a DLL by name, Windows searches a sequence of folders. If a malicious copy sits in a folder searched earlier, it is loaded instead of the legitimate one.

The variants

Search order hijacking: the app's folder is searched early; if writable, you drop the DLL there.

DLL sideloading: a signed, legitimate executable loads a DLL by a known name; you copy it into your folder alongside the malicious DLL. The process looks legitimate (LOLbin).

Phantom DLL: a DLL searched for but absent on the system — just create it.

Defence

Absolute paths when loading, SetDefaultDllDirectories, signed and validated DLLs, correct permissions on app folders (not user-writable). WDAC to block untrusted DLLs. Monitor DLL loads from anomalous paths.