
WFP Interference with DLL Hijacking
HackingCybersecurityMalwareWindows
The poster identified a vulnerable application with a missing DLL, attempting a standard DLL hijack. When placing their DLL in the target folder, the application skips loading it without errors, and Procmon logs a "path not found" message for the DLL. They suspect a custom Windows Filtering Platform (WFP) filter may be blocking the DLL load but are unsure if WFP can interfere with userland DLL loading. Testing different DLL names produced the same result.