DLL sideloading and C2 masking: what endpoint teams need to know

TL;DR: Attackers can combine a signed application, a replaced DLL, a persistence task, indirect syscalls, and cookie-based C2 to stay hidden while loading shellcode into memory, according to Expel. The case underscores that endpoint control failures now hinge on trust in signed binaries, process lineage, and outbound traffic inspection, not just malware detection.

NHIMG editorial — based on content published by Expel: LLMjacking and evasive loader analysis through compromised NHIs

Questions worth separating out

Q: What breaks when DLL sideloading is possible in trusted software downloads?

A: DLL sideloading breaks the assumption that a trusted executable only runs trusted code.

Q: Why do signed binaries and portable apps increase endpoint risk?

A: They increase risk when security tools rely on binary reputation more than runtime behaviour.

Q: How do security teams detect memory-resident malware that uses indirect syscalls?

A: They need telemetry that goes beyond user-mode hooks, including kernel-aware detection, process ancestry, suspicious memory allocation patterns, and unusual transitions from writable to executable memory.

Practitioner guidance

• Harden DLL loading paths Restrict unsafe DLL search order, validate library provenance, and monitor for unexpected sibling DLLs loaded by signed applications in user-writable locations.
• Correlate scheduled task creation with memory execution Alert on new scheduled tasks that relaunch newly seen binaries and pair that with process-memory transitions such as RW to RX changes or shellcode-like allocation patterns.
• Inspect proxy logs for hidden payload channels Look for suspicious cookie values, odd user-agent combinations, and requests that mimic common CDN or library fetches while carrying encoded data.

What's in the full article

Expel's full post covers the technical detail this post intentionally leaves for the source:

• The exact reverse-engineering walk-through of the malicious GreenshotPlugin.dll and updater.dll chain
• The indirect syscall technique and how the loader calculates syscall numbers to bypass hooks
• The full C2 request structure, including the cookie field used to hide encrypted data
• The indicators of compromise and hashes for the files observed in the campaign

👉 Read Expel's analysis of evasive DLL sideloading and C2 masking →

DLL sideloading and C2 masking: what endpoint teams need to know?

Explore further

View Full Forum →  |  NHI Foundation Course →