Scan Profiles
A profile sets the starting values for the confidence threshold, canary behavior, ETW, and trigger sources. You select one with -p / --profile; individual flags override specific profile settings. The default is aggressive.
Profiles
Section titled “Profiles”| Profile | Purpose |
|---|---|
aggressive (default) |
Full pipeline. Runs canary confirmation and ETW discovery, and enumerates all five execution vectors. |
safe |
Static-only analysis, safe to run on production systems. No canary DLLs are deployed. |
uac-bypass |
Focuses on UAC bypass paths — auto-elevate binaries and the side-load / DotLocal vectors that lead to elevation. |
redteam |
Reports Confirmed findings only, tuned for operator use and JSON output. |
aggressive
Section titled “aggressive”The default. Run with no arguments to use it.
.\DLLHijackHunter.exeRuns canary confirmation and ETW discovery, enumerates all five execution vectors, and prints a tiered console report. Add --output to save an HTML or JSON report:
.\DLLHijackHunter.exe --profile aggressive --output report.htmlStatic-only, with no canary deployment — appropriate for production systems where triggering binaries is undesirable.
.\DLLHijackHunter.exe --profile safeuac-bypass
Section titled “uac-bypass”Restricts the scan to UAC bypass paths.
.\DLLHijackHunter.exe --profile uac-bypassredteam
Section titled “redteam”Surfaces only Confirmed findings, and pairs naturally with JSON output for downstream tooling.
.\DLLHijackHunter.exe --profile redteam --output confirmed.json