Detect DLL side-loading and search-order hijacking (MITRE T1574) where adversaries plant malicious DLLs for legitimate signed applications to load, by analyzing Sysmon Event ID 7 DLL-load events, checking signatures/hashes against known-good versions, and flagging path anomalies with EDR tools like CrowdStrike, MDE, or SentinelOne. Use when investigating EDR alerts on unsigned DLLs, hunting for APT persistence via trojanized applications, or triaging incidents involving DLL hijacking.
Install
KitScout test notes
Not tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.
Similar tools
ponytail-audit190,451 ★ Quality audit of the whole repo: bugs, security, real load, missing tests, speed, and what to delete. Most imp
ponytail-debt190,451 ★ Harvest every shortcut: comment into one debt ledger, so deferrals get tracked instead of forgotten. One-shot
security-and-hardening117,221 ★ Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling us
deal-with-security-advisory113,505 ★ Handle confidential GitHub Security Advisory response for Paperclip. Use when coordinating advisory triage, pr
html-ppt-knowledge-arch-blueprint107,550 ★ OpenDesign's incident retro: the daemon-restart data bug, the root cause, the fix, and the systemic follow-ups