Methods and apparatus to defend against DLL side-loading attacks

At least one non-transitory computer readable storage medium comprising instructions that, when executed, cause at least one processor to at least:

• determine a first dynamic-link library (DLL) fingerprint of a first DLL referenced by an operating system (OS) event, the OS event generated by a computing device, the first DLL stored at a first OS path;
• in response to determining that a second DLL is stored at a second OS path, determine a second DLL fingerprint of the second DLL, the second DLL having the same name as the first DLL, the second OS path superseding the first OS path;
• determine whether at least one of the first DLL fingerprint or the second DLL fingerprint satisfies a deviation threshold based on a comparison of the first DLL fingerprint and the second DLL fingerprint to a reference DLL fingerprint;
• and
• execute a security action to protect the computing device from an attack in response to the deviation threshold being satisfied.

An apparatus to detect an attack at a computing device, the apparatus comprising:

• means for determining to determine a first dynamic-link library (DLL) fingerprint of a first DLL referenced by an operating system (OS) event, the OS event generated by the computing device, the first DLL stored at a first OS path, and in response to determining that a second DLL is stored at a second OS path, a second DLL fingerprint of the second DLL, the second DLL having the same name as the first DLL, the second OS path superseding the first OS path;
• means for comparing to compare the first DLL fingerprint and the second DLL fingerprint to a reference DLL fingerprint, and determine whether at least one of the first DLL fingerprint or the second DLL fingerprint satisfies a deviation threshold based on the comparison;
• and
• means for executing a security action to protect the computing device from the attack in response to the deviation threshold being satisfied.

A method to detect an attack at a computing device, the method comprising:

• determining a first dynamic-link library (DLL) fingerprint of a first DLL referenced by an operating system (OS) event, the OS event generated by the computing device, the first DLL stored at a first OS path;
• in response to determining that a second DLL is stored at a second OS path, determining a second DLL fingerprint of the second DLL, the second DLL having the same name as the first DLL, the second OS path superseding the first OS path;
• determining whether at least one of the first DLL fingerprint or the second DLL fingerprint satisfies a deviation threshold based on a comparison of the first DLL fingerprint and the second DLL fingerprint to a reference DLL fingerprint;
• and
• in response to the deviation threshold being satisfied, executing a security action to protect the computing device from the attack.

An apparatus to detect an attack at a computing device, the apparatus comprising:

• memory;
• instructions;
• and
• processor circuitry to execute the instructions to at least:
• determine a first dynamic-link library (DLL) fingerprint of a first DLL referenced by an operating system (OS) event, the OS event generated by the computing device, the first DLL stored at a first OS path;
• in response to determining that a second DLL is stored at a second OS path, determine a second DLL fingerprint of the second DLL, the second DLL having the same name as the first DLL, the second OS path superseding the first OS path;
• determine whether at least one of the first DLL fingerprint or the second DLL fingerprint satisfies a deviation threshold based on a comparison of the first DLL fingerprint and the second DLL fingerprint to a reference DLL fingerprint;
• and
• execute a security action to protect the computing device from the attack in response to the deviation threshold being satisfied.