# Signed binary DLL side-loading

Signed EXE or config loading a DLL by name from its own or a writable directory

_Area: Memory corruption and native code. Seen in 3 disclosed reports; latest 2026-03-06. Updated 2026-10-31._

## How it works
A signed executable or a config-driven loader resolves a library by bare name, so the OS search order picks up a DLL sitting next to the EXE or in a user-writable path. The signature on the host binary is trusted, but the library it loads is not pinned to a trusted location, so an attacker who can write a file into that directory gets code execution under the signed process's identity. The broken assumption: "this signed program only loads code we shipped."

## Where it shows up
- Signed EXEs that call `LoadLibraryA`/`LoadLibraryEx` with a bare DLL name rather than a full path [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-advanced-techniques-used-in-malaysian-focused-apt-campaign.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-muddywater-attack-chain.md).
- Office or other host processes loading DLLs from user-writable paths such as `C:\Users\Public` or `AppData\Local`, especially `.tmp` extensions [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-advanced-techniques-used-in-malaysian-focused-apt-campaign.md).
- Config/INI fields that name a plugin or driver, used as a path without sanitization [E2](https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2022-09-aveva-edge.md).
- Relative traversal (`..\`) or UNC paths accepted in a driver/plugin name field [E2](https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2022-09-aveva-edge.md).
- Legitimate vendor utilities (camera, audio, telephony software) run from writable directories [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-advanced-techniques-used-in-malaysian-focused-apt-campaign.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-muddywater-attack-chain.md).

## How to review
For every signed binary and every config-driven loader, find each library load and check the exact property: the resolved path must be absolute and confined to a trusted, non-writable directory, or the library must be loaded by full path. Treat any bare-name load, any name taken from a project/config file, and any load from the EXE's own directory as unsafe unless the directory is proven non-writable by unprivileged users. For config fields, verify the value is validated as a bare name (no separators, no UNC) and resolved against a fixed trusted base. Use Procmon to confirm where drivers/DLLs actually load from [E2](https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2022-09-aveva-edge.md).

## Variants seen
- Signed vendor EXE side-loads a same-directory DLL dropped by a phishing lure [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-advanced-techniques-used-in-malaysian-focused-apt-campaign.md).
- Project INI `[UsedDrivers]` value used as a path, redirecting load to a UNC share [E2](https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2022-09-aveva-edge.md).
- Legitimate signed utility (FMAPP.exe) side-loads a malicious same-directory DLL for C2 [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-muddywater-attack-chain.md).

## Impact and severity
Led to persistent in-memory implants and C2 on targeted hosts, including government and enterprise victims [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-advanced-techniques-used-in-malaysian-focused-apt-campaign.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-muddywater-attack-chain.md), and arbitrary code execution from opening a project file [E2](https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2022-09-aveva-edge.md). Severity is high: code runs under a trusted signed process, evading detection, and in E2 needs only a crafted file opened. Worse when the host is internet/RDP-exposed [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-muddywater-attack-chain.md) or the load happens automatically on open [E2](https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2022-09-aveva-edge.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-advanced-techniques-used-in-malaysian-focused-apt-campaign.md
- E2: https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2022-09-aveva-edge.md
- E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-muddywater-attack-chain.md