Detecting DLL hijacking with machine learning: real-world cases

Detecting DLL hijacking with machine learning: real-world cases explains how a machine‑learning model embedded in Kaspersky SIEM identifies DLL‑hijacking attacks and is integrated into the platform’s MDR workflows. According to Securelist, the model can run on a correlator or a collector, checking loaded libraries against local attributes and a global knowledge base via the KSN cloud to improve detection and reduce false positives.

The article details three incidents flagged during pilot testing: Incident 1, ToddyCat leveraging CVE-2021-27076 to trigger a DLL sideloading attack against a SharePoint IIS service, with SystemSettings.dll and SystemSettings.exe involved and a scheduled task disguised as a Microsoft Edge update to achieve persistence.

Incident 2 saw Infostealer activity masquerading as policymanager.dll next to SettingSyncHost.exe, with the load targeting browser data files and a DLL hijacking technique listed in the HijackLibs project. Incident 3 involved a malicious loader posing as a security solution when a USB drive delivered CEFHelper.exe, which loaded wsc.dll via DLL sideloading and opened AvastAuth.dat for a backdoor.

The authors note that the ToddyCat APT group was highly likely behind Incident 1, and assert that the model enabled prompt response to block the activity, underscoring the model’s value for proactive enterprise protection.