DLL sideloading is a technique used in Windows environments where attackers exploit the way the operating system searches for and loads Dynamic Link Libraries (DLLs), which are files containing code and data used by multiple applications.
When an application needs to load a DLL, Windows follows a specific search order to locate the required file. This order typically starts with the directory from which the application was loaded, then checks system directories, the Windows directory, and finally directories listed in the PATH environment variable. If the application does not specify the full path to the DLL it needs, or if the manifest file (which describes dependencies and configuration) is not explicit enough, Windows may load a malicious DLL placed in a directory that is checked before the legitimate one.
Attackers take advantage of this behavior by placing a malicious DLL with the same name as a legitimate one in a location where it will be found and loaded first, such as the application’s own directory. When the application is launched, it inadvertently loads the malicious DLL instead of the intended one, allowing the attacker to execute arbitrary code—often with the privileges of the trusted application. This technique is commonly used for persistence, privilege escalation, and evading detection by security solutions, as malicious activity appears to originate from a legitimate, signed process.
DLL sideloading is closely related to DLL hijacking, but in sideloading, the attacker typically distributes both a legitimate application and the malicious DLL together, whereas in hijacking, the attacker may target libraries already present on the victim’s system. Both techniques are widely used by advanced threat actors and malware operators to bypass security controls and maintain access to compromised systems.