Microsoft introduced Component Object Model (COM) in Windows 3.11
Hikit has used DLL Search Order Hijacking to load oci.dll as a persistence
DLL Hijacking, commonly referred to as load order or search order
Applications can control the location from which a DLL is loaded by
In order to do a preliminary examination, we decided to focus on phantom COM ... COM object hijacking is a technique in which malicious software can replace a ... Upon initial load, remove the added DLL to reduce visibility and add it again
Hijacking a COM object requires a change in the Windows Registry to replace a reference to
Finjan Best Practices to Prevent DLL Hijacking
If Windows locates the DLL within the DLL Search Order, it will load that DLL.
This technique is documented as DLL Search Order Hijacking in the
feature by placing a malicious DLL in one of these directories. In these ... Traditionally, search-order hijacking attacks utilize an