DataDog / guarddog

:snake: :mag: GuardDog is a CLI tool to Identify malicious PyPI and npm packages
https://securitylabs.datadoghq.com/articles/guarddog-identify-malicious-pypi-packages/
Apache License 2.0
611 stars 44 forks source link

Add DLL hijacking detection #382

Closed sobregosodd closed 4 months ago

sobregosodd commented 4 months ago

Adds new rule that detects when is attempted to load arbitrary DLL or Shared Object to gain execution. The goal is to detect the most common patterns for DLL hijacking, among:

See here for more information on techniques

A false positive analysis scan was performed with the following results: