T1574.001 Hijack Execution Flow: DLL

2 threats tracked by Spectrum Delta use this technique.

T1574.001 on MITRE ATT&CK →

• Bronze Sandcastle

  DLL sideloading: legitimate executables load malicious sibling DLLs

  Sysmon Event ID 7 (Image loaded) events: the loading process (Image) is one of the legitimate executables and the loaded module (ImageLoaded) is the sibling DLL (sbiedll.dll, jli.dll, Krita.dll, NvdaHelperRemote.dll, Libcef.dll, Version.dll, msvcp140.dll, snmpapi.dll) with Hashes and signature fields for correlation — Microsoft documents this event as disabled by default, requiring the -l configuration and careful filtering because unfiltered image-load logging is very noisy (Microsoft Learn, B/1). EDR image-load streams are the alternative where deployed. Process-creation events show the legitimate executable running but do not by themselves establish the DLL load; the config.ini read-then-execute behavior is visible only to EDR behavioral telemetry

  Seen in: Sysmon Event ID 7 image loads

• Lazarus FlashHole

  mscoree.dll side-loading (TouchHub/TouchShift persistence)

  Sysmon EID 7 image loads: mscoree.dll loaded from RasConv/ProgramData paths; EID 11 file creation of mscoree.dll and ActivationStore.dat

  Seen in: Sysmon / EDR