vermillion-hunter

Overview

Frida-based dynamic instrumentation for identifying Windows "features" exploitable for:

• DLL Sideloading (T1574.002)
• COM Hijacking (T1546.015)

WFH Dridex variant: ~966 validated sideloads vs 96 from original.

MITRE ATT&CK Mapping

T1574.002 - DLL Side-Loading