DLL Side-Loading × McAfee Agent

unsigned DLL preloading attack enabling loading of malicious libraries (CVE-2021-31840)

CVE-2021-31839: Local authenticated user can edit the agent's event log before it is sent to the ePO server, potentially hiding malicious activity. CVE-2021-31840: Application loads DLLs without proper validation, allowing a local attacker to place a malicious DLL in a location where it will be loaded by the agent, leading to code execution.

Monitor for unexpected DLL loads by McAfee Agent processes (e.g., Masvc.exe) from non-standard directories using Sysmon Event ID 7 or EDR telemetry; enforce code-signing validation and restrict write permissions to agent installation paths to prevent malicious DLL placement.