Lateral Movement — SCM and DLL Hijacking Primer

Published

2019-04-18 14:37

Collected

2026-10-17 10:45

---
id: 9838
title: "Lateral Movement — SCM and DLL Hijacking Primer"
source_domain: specterops.io
source_url: "https://specterops.io/blog/2019/04/18/lateral-movement-scm-and-dll-hijacking-primer/"
published_at: "2019-04-18T14:37:00Z"
phying_url: "https://phying.com/item/9838"
lang: en
---

# Lateral Movement — SCM and DLL Hijacking Primer

## Summary

Summary As Defenders increase in maturity, the more they are able to leverage built-in utilities against attackers. PowerShell has a tremendous amount of verbose logging and introspection, service creation and manipulation is often flagged, and permanent WMI event subscriptions are caught by both Windows EventID 5861 and Sysmon. Dynamic Link Library (DLL) hijacking has been […]

## Intelligence Metadata

- **Sources:** specterops.io
- **Published:** 2019-04-18T14:37:00Z
- **Original:** https://specterops.io/blog/2019/04/18/lateral-movement-scm-and-dll-hijacking-primer/
- **Phying News:** https://phying.com/item/9838