Overview

DLLHijackHunter is a Windows security tool that automates the discovery, validation, and confirmation of DLL hijacking vulnerabilities. It runs as a standard user or administrator, enumerates execution vectors across the system, and — wherever possible — deploys a canary DLL to prove the hijack actually works before reporting it.

The goal is a short list of things that are true, not a long list of things that might be.

What it finds

DLLHijackHunter identifies seven distinct hijack types:

Type	Description
Phantom	A binary tries to load a DLL that doesn’t exist on disk
SearchOrder	A writable directory precedes the legitimate DLL in the Windows search order
SideLoad	An auto-elevate binary can be copied to a writable folder with a DLL placed next to it
DotLocal	The .local redirection mechanism is exploitable because the binary’s directory is writable
EnvPath	A writable directory in the system PATH precedes the real DLL
AppInitDll	AppInit_DLLs registry entry points to a writable DLL path — achieves global injection
AppCertDll	AppCertDlls registry entry points to a writable path — injects into every CreateProcess call

How it compares

Tool	What it does	What it misses
Robber	Searches PATH for missing DLLs	No canary confirmation, no service/task enumeration
DLLSpy	Static import analysis	No writability check, no confirmation
WinPEAS	Broad privilege escalation checklist	DLL hijacking is one small check among many
DLLHijackHunter	Full pipeline: discover → filter → verify → confirm	Requires Windows; canary deployment requires admin for service triggers

The differentiator is confirmation. A finding at the Confirmed tier means a canary DLL ran in the context of the target process and wrote back its privilege, integrity level, and SeDebugPrivilege status. No guessing.

Discovery sources

The tool covers five execution contexts:

• Services — native Windows services via SCM
• Scheduled Tasks — periodically-triggered executables
• Startup Items — registry and folder-based autostart mechanisms
• COM Objects — CLSID registry entries (InprocServer32 and LocalServer32); detects phantom COM objects where the registered binary no longer exists
• AutoElevate Binaries — binaries with <autoElevate>true</autoElevate> in their manifests or COM elevation flags, for UAC bypass paths

Pipeline

Every scan runs through five phases:

1. Discovery — enumerate binaries and their DLL dependencies across all five vectors
2. Filtration — eliminate false positives via hard gates (API sets, KnownDLLs, unwritable paths) and soft gates (confidence penalties for manifests, signatures, secure flags)
3. Load Verification (optional, --verify-load) — ask the Windows loader directly whether a probe at the writable path would win the DLL resolution race
4. Canary Confirmation (optional, on by default) — deploy a benign test DLL, trigger the binary, poll for the confirmation file
5. Scoring & Reporting — tier findings by confidence, compute impact scores, correlate multi-step attack chains

Selected for Black Hat SecTor Arsenal

DLLHijackHunter was selected for the Black Hat SecTor Arsenal (Toronto, October 2026). Session: DLLHijackHunter: Validation-Driven Discovery and Confirmation of DLL Hijacking Paths on Windows.