Detection of Dynamic Link Library (DLL) Side Loading Attacks

A system for detecting a cyber-attack, the system comprising:

• an input interface, configured to receive events occurring in a computer system;
• and
• one or more processors, configured to:
• identify an event occurring in a computer belonging to the computer system, the event comprising loading of an application memory together with a Dynamic Link Library (DLL);
• apply to the event a filtering criterion, which verifies that (i) the application and the DLL are loaded from a same folder, (ii) the application is signed and verified and (iii) the DLL does not have a valid signature;
• responsively to meeting the filtering criterion, apply to the event a profiling criterion, which verifies that prevalences of defined characteristics of the DLL in the computer system are below defined prevalence levels;
• and
• responsively to meeting the profiling criterion, decide that the DLL is suspected of being malicious.