CLI Reference

All flags below can be combined. Profile flags set starting values; individual flags override specific profile settings.

Flags

-p, --profile

Default: aggressive

Selects the scan profile. Profiles set the starting values for confidence threshold, canary behavior, ETW, and trigger sources. Individual flags below can override specific profile settings.

Available profiles: aggressive (default), safe, uac-bypass, and redteam. See Scan Profiles for what each one configures.

--target

Restricts the scan to a specific application binary instead of enumerating every execution vector on the system.

.\DLLHijackHunter.exe --target "C:\Program Files\MyApp\app.exe"

--output

Writes the report to a file. The format is inferred from the extension — .html produces an HTML report, .json produces machine-readable JSON.

.\DLLHijackHunter.exe --profile aggressive --output report.html

--verify-load

Enables the optional Load Verification phase. Instead of only reasoning statically, the tool asks the real Windows loader whether a probe at the writable path would win the DLL resolution race. Verifies search order without deploying canary DLLs.

--no-canary

Disables Canary Confirmation. No benign test DLL is deployed and no binaries are triggered. Findings can still reach static tiers, but none will be promoted to Confirmed.

--no-etw

Disables ETW-based discovery. Useful for lower-privilege runs or to avoid ETW overhead.

--lpe-only

Local privilege escalation triage mode. Skips System32 and Program Files and reports only findings that are exploitable by unprivileged (standard) users.

.\DLLHijackHunter.exe --lpe-only --no-canary --no-etw --verify-load