A new Dynamic Link Library (DLL) search order hijacking technique has come to light that allows threat actors to execute arbitrary code on devices that run Windows 10 and Windows 11 within the Windows folder. DLL search order hijacking works by manipulating the sequence that applications use components such as DLLs and executables that may not have been included in the installation package of the application. By injecting code into a targeted process, the threat actor can successfully execute the code in an environment that is classified as safe and trusted so it is less likely to be captured by security tools. Cybersecurity firm Security Joes states in their report that the malicious code is run using a trusted binary under the folder WinSxS (Windows Side by Side). By targeting processes in the WinSxS folder, researchers managed to create more efficient DLL hijacking due to the unique properties of the folder. There are no privilege escalation requirements needed to run the code as the elevated privileges already exist in the WinSxS folder, and threat actors can use the existing trusted binaries in the folder to execute their code to avoid introducing their own binaries that could be more easily detected by security services. This creates a scenario where the OS believes it is executing a trusted application in a trusted environment which is subject to much less scrutiny. Researchers at Security Joes successfully demonstrated a proof of concept of this technique by inserting a custom DLL into the designated directory that mimicked the name of another uncompromised DLL that the researchers knew would be targeted by a specific binary. Once executed, the binary discovered the custom DLL and loaded that instead of the uncompromised DLL. CTIX analysts will continue to monitor developments of this new technique and industry responses to this new threat.