Bypass Record
DLL Side-Loading × Microsoft Defender SmartScreen
A publicly-reported instance of DLL Side-Loading bypassing Microsoft Defender SmartScreen, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The attack exploits CVE-2024-21412 by using internet shortcut (.url) files hosted on WebDAV shares. When a user clicks a phishing link, the .url file points to a malicious MSI installer on a remote server. SmartScreen fails to properly validate the source, allowing the MSI to execute. The MSI then performs DLL sideloading to decrypt and run the ACR Stealer payload, which employs anti-analysis techniques like XOR encoding and obfuscation.
Detection & mitigation
Monitor for execution of MSI files from unusual network locations, especially WebDAV shares. Detect DLL sideloading by looking for unsigned DLLs loaded from non-standard paths. Apply CVE-2024-21412 patch and enforce SmartScreen via GPO.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.