Research on PEB-LDR Data Analysis Technique for DLL Injection Detection on ICS Engineering Workstation

In the field of Industrial Control Systems (ICS), engineering workstations are used to manage and control processes better. It can involve monitoring the status of the PLC (Programming Logic Controller) constituting the ICS and observing the PLC data in real time using the HMI function. Nonetheless, it is possible to gain control of SCADA through a DLL injection, which can cause a fatal accident. Therefore, this paper proposes a method of detecting the DLL Injection of engineering workstations used in the ICS environment and a technique to detect data change due to DLL Injection by analyzing PEB-LDR data. We also propose a method of detecting malicious DLL when such is suspected to have been loaded. As a result, successful detection was realized using the suggested method when DLL Injection occurred, and a warning message could be displayed.