An EDR alert shows a legitimate antivirus process (avgnt.exe) loading an unsigned DLL from C:\Temp\msdetour.dll. What attack technique does this most likely represent?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because loading an unsigned DLL from C:\Temp\ into a security product process is a classic DLL side-loading technique — the trusted process's security context is hijacked, potentially bypassing application controls that whitelist the parent process. A is wrong because legitimate AV updates use vendor-signed DLLs loaded from trusted installation directories.
Full explanation below image
Full Explanation
B is correct because loading an unsigned DLL from C:\Temp\ into a security product process is a classic DLL side-loading technique — the trusted process's security context is hijacked, potentially bypassing application controls that whitelist the parent process. A is wrong because legitimate AV updates use vendor-signed DLLs loaded from trusted installation directories. C is wrong because Windows security drivers are signed and loaded from system directories, not Temp. D is wrong because self-update mechanisms do not load runtime DLLs from C:\Temp\.