TGViewer
Sec Note Sec Note @secnote · 2.89K subscribers
Post #182 1.39K
sideloading PoC using onedrive.exe & version.dll

This document provides a detailed technical analysis of a proof-of-concept that demonstrates DLL sideloading by targeting OneDrive.exe with a malicious version.dll. This technique is leveraged for achieving persistence, evading defenses, and executing arbitrary code within the context of a trusted process. The proof-of-concept further employs DLL proxying to maintain the normal operation of the host application and utilizes a sophisticated hooking mechanism based on Vectored Exception Handling (VEH) and hardware-like breakpoints to intercept and modify application behavior.
  • 👾 6
More from @secnote
  1. Sep 27, 2026EDR Evasion: Process Injection Without WriteProcessMemory #EDR #maldev
  2. Sep 25, 2026سلام و درود لنگ ظهر جمعه تون بخیر فایل 4 دوره #SEC530 خدمت شما. واقعا طولانی شد 😅
  3. Sep 24, 2026Sec Note pinned a photo
  4. Sep 24, 2026My New Blog Post Evading Sysmon Dns Monitoring In 2026 | binary-win DNSevade : https://git…
  5. Sep 23, 2026Did Sysmon miss the DNS event?👀
  6. Sep 22, 2026fbi job portal defaced and compromised? oh yeah, it's a silly tuesday
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →