This document provides a detailed technical analysis of a proof-of-concept that demonstrates DLL sideloading by targeting OneDrive.exe with a malicious version.dll. This technique is leveraged for achieving persistence, evading defenses, and executing arbitrary code within the context of a trusted process. The proof-of-concept further employs DLL proxying to maintain the normal operation of the host application and utilizes a sophisticated hooking mechanism based on Vectored Exception Handling (VEH) and hardware-like breakpoints to intercept and modify application behavior.
Post #182
1.39K
sideloading PoC using onedrive.exe & version.dll
- 👾 6