DLL sideloading

copy payload.dll "C:\Program Files\App\version.dll"

Place a malicious DLL with the name of a legitimate DLL that an application loads from its own folder: the app executes your code without anyone having modified it.

Use it when you have an application vulnerable to DLL side-loading (look for DLLs it loads from its directory instead of System32) and you want persistence or code execution under the signature of a legitimate process. It is the favorite way to hide loaders in environments with executable whitelisting.

If the app is signed and the EDR validates the load chain (Sysmon Event 7 with ImageLoaded outside the expected path), the foreign DLL will be flagged. Also not if the original DLL is updated with the program: the next update overwrites your version.