Quick Start

Basic scan

Run with no arguments to use the aggressive profile (the default):

.\DLLHijackHunter.exe

This runs canary confirmation and ETW discovery, enumerates all five execution vectors, and prints a tiered console report.

Common starting points

Full aggressive scan, save HTML report:

.\DLLHijackHunter.exe --profile aggressive --output report.html

Static-only, safe for production systems:

.\DLLHijackHunter.exe --profile safe

LPE triage as a standard user:

.\DLLHijackHunter.exe --lpe-only --no-canary --no-etw --verify-load

Skips System32 and Program Files, reports only findings exploitable by unprivileged users, and verifies search order with the real Windows loader without deploying canary DLLs.

UAC bypass paths only:

.\DLLHijackHunter.exe --profile uac-bypass

Target a specific application:

.\DLLHijackHunter.exe --target "C:\Program Files\MyApp\app.exe"

Confirmed findings only, JSON output:

.\DLLHijackHunter.exe --profile redteam --output confirmed.json

Reading the output

The console report shows:

• A summary table with hostname, OS, scan duration, and candidate counts
• A tier breakdown bar chart (CONFIRMED → HIGH → MEDIUM → LOW)
• Per-finding panels with binary path, DLL name, hijack path, trigger, execution account, canary result, reboot persistence, and notes

Findings at the Confirmed tier have a canary execution record: the privilege level, integrity level, and SeDebugPrivilege status of the process that loaded the canary DLL.