UNC1549 DLL Search Order Hijacking

Tim Peck@timpeck

•updated Nov 17, 2025•1•0•93

Detects potential DLL Search Order Hijacking activity where a DLL is created in a legitimate software directory, followed by a process execution from that same directory. This pattern is consistent with UNC1549's technique of dropping malicious DLLs to be loaded by trusted applications.