Typical severity: High. Likelihood of attack: Low. An adversary places a malicious version of a Dynamic-Link Library (DLL) in the Windows Side-by-Side (WinSxS) directory to trick the operating system into loading this malicious DLL instead of a legitimate DLL. Programs specify the location of the DLLs to load via the use of WinSxS manifests or DLL redirection and if they aren't used then Windows searches in a predefined set of directories to locate the file. If the applications improperly specify a required DLL or WinSxS manifests aren't explicit about the characteristics of the DLL to be loaded, they can be vulnerable to side-loading.
Prevent unknown DLLs from loading through using an allowlist policy. | Patch installed applications as soon as new updates become available. | Properly restrict the location of the software being used. | Use of sxstrace.exe on Windows as well as manual inspection of the manifests. | Require code signing and avoid using relative paths for resources.