What is DLL Side Loading?

DLL side-loading is attractive to attackers because it lets malicious code run under the cover of a legitimate, trusted application — making detection and blocking significantly harder. It is mapped to MITRE ATT&CK under Hijack Execution Flow (T1574.002) and consistently appears in both commodity malware campaigns and sophisticated, targeted intrusions.

It abuses trusted, signed binaries. Attackers look for legitimate applications that load DLLs from their current directory or from writable paths without strict validation, then drop a malicious DLL with the expected filename right next to the executable. The trusted program does the heavy lifting for them. Huntress has observed this pattern with a range of legitimate applications, including tools like ADNotificationManager.exe and DLPUserAgent.exe, being co-opted to load malicious payloads without any modification to the binaries themselves.

It is purpose-built for defense evasion. Because the parent process is a well-known, signed application, security tools are far less likely to flag its activity as suspicious. This is exactly why the technique falls under the "defense evasion" tactic in MITRE ATT&CK. The malicious DLL rides inside a trusted process and can inherit that process's implicit "trust" — making it harder for both security appliances and human analysts to catch.

It hides in the noise. Side-loaded DLLs are typically dropped into locations that already contain a high volume of legitimate application files, such as %ProgramData% subdirectories and user profile data folders. Unsigned DLLs sitting in these directories are a well-documented tradecraft marker, but they can be easy to overlook without dedicated monitoring. In the Huntress investigation into a fake tech support campaign delivering Havoc C2, malicious DLLs were dropped into %PROGRAMDATA%\Adobe\ARM — a location designed to blend in with legitimate Adobe software activity.

It enables stealthy, boot-persistent access. Once a vulnerable application is configured to run at startup or is already installed as a service, a malicious DLL placed beside it will be loaded automatically on every boot. In the Havoc C2 campaign observed by Huntress, adversaries went a step further, deploying scheduled tasks that reconstructed and relaunched the side-loaded payload on each system restart — ensuring persistence even after initial remediation attempts.