examples:

• description: "Place malicious mscorsvc.dll in the search order location" command: "copy malicious.dll "%WINDIR%\Microsoft.NET\Framework\v%VERSION%\mscorsvc.dll""
• description: "Execute the vulnerable binary to trigger the hijack" command: ""%WINDIR%\Microsoft.NET\Framework\v%VERSION%\mscorsvw.exe""

mscorsvc.dll

Vendor: Microsoft

Expected Location: %WINDIR%\Microsoft.NET\Framework\v%VERSION%

Vulnerable Executables:

• %WINDIR%\Microsoft.NET\Framework\v%VERSION%\mscorsvw.exe (Sideloading)
• %WINDIR%\WinSxS\amd64_netfx4-ngentask_exe_%VERSION%\ngentask.exe (Phantom)

Acknowledgement: Michał Kucharski