Kaspersky Develops ML Model to Combat DLL Hijacking Attacks

• •Kaspersky's ML model enhances detection of DLL hijacking attacks.
• •DLL hijacking is increasingly used by cybercriminals, complicating detection efforts.
• •Real-world incidents have already been uncovered using the new detection model.

Kaspersky has integrated a machine-learning model into its SIEM system to detect DLL hijacking attacks, a technique increasingly used by cybercriminals. DLL hijacking involves replacing legitimate libraries with malicious ones, making detection challenging. Recent incidents include ToddyCat attempting to launch Cobalt Strike disguised as a system library and an infostealer masquerading as a policy manager. The model analyzes DLL libraries loaded by processes and validates them against a global knowledge base to enhance detection accuracy. This development comes amid a notable rise in DLL hijacking incidents globally, affecting organizations in various regions. Kaspersky's model aims to improve security without significantly impacting system performance. The integration of this model is part of ongoing efforts to combat the growing threat landscape.