Bypass Record
DLL Side-Loading × Zabbix Agent for Windows
A publicly-reported instance of DLL Side-Loading bypassing Zabbix Agent for Windows, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
Zabbix Agent on Windows links against OpenSSL, which reads openssl.cnf from a directory writable by standard users. An attacker modifies this file to include a dynamic_path directive pointing to a malicious DLL. On agent restart, OpenSSL loads the DLL, executing attacker code in the agent's privileged security context.
Detection & mitigation
Monitor for unexpected DLL loads by the Zabbix Agent process (zabbix_agentd.exe) from world-writable directories, especially OpenSSL-related DLLs loaded from non-standard paths. Mitigate by restricting write permissions on the OpenSSL configuration directory and applying the vendor patch to prevent loading of untrusted DLLs.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.