diff --git a/lookups/hijacklibs.csv b/lookups/hijacklibs.csv
new file mode 100644
index 0000000000..058c68f5fc
--- /dev/null
+++ b/lookups/hijacklibs.csv
@@ -0,0 +1,347 @@
+library,islibrary
+outllib.dll,TRUE
+iviewers.dll,TRUE
+hha.dll,TRUE
+aclui.dll,TRUE
+xwtpw32.dll,TRUE
+xwizards.dll,TRUE
+xolehlp.dll,TRUE
+xmllite.dll,TRUE
+wwapi.dll,TRUE
+wwancfg.dll,TRUE
+wtsapi32.dll,TRUE
+wshelper.dll,TRUE
+wshbth.dll,TRUE
+wpdshext.dll,TRUE
+wofutil.dll,TRUE
+wmsgapi.dll,TRUE
+wmpdui.dll,TRUE
+wmiutils.dll,TRUE
+wmidcom.dll,TRUE
+wmiclnt.dll,TRUE
+wlidprov.dll,TRUE
+wldp.dll,TRUE
+wlbsctrl.dll,TRUE
+wlancfg.dll,TRUE
+wlanapi.dll,TRUE
+wkscli.dll,TRUE
+winsta.dll,TRUE
+winsqlite3.dll,TRUE
+winrnr.dll,TRUE
+winnsi.dll,TRUE
+winmm.dll,TRUE
+winmde.dll,TRUE
+winipsec.dll,TRUE
+wininet.dll,TRUE
+winhttp.dll,TRUE
+windowsudk.shellcommon.dll,TRUE
+windowsperformancerecordercontrol.dll,TRUE
+windowscodecsext.dll,TRUE
+windowscodecs.dll,TRUE
+windows.storage.search.dll,TRUE
+windows.storage.dll,TRUE
+winbrand.dll,TRUE
+wimgapi.dll,TRUE
+whhelper.dll,TRUE
+wevtapi.dll,TRUE
+wer.dll,TRUE
+wecapi.dll,TRUE
+webservices.dll,TRUE
+wdscore.dll,TRUE
+wdi.dll,TRUE
+wcnnetsh.dll,TRUE
+wcmapi.dll,TRUE
+wbemsvc.dll,TRUE
+wbemprox.dll,TRUE
+vsstrace.dll,TRUE
+vssapi.dll,TRUE
+virtdisk.dll,TRUE
+vaultcli.dll,TRUE
+uxtheme.dll,TRUE
+uxinit.dll,TRUE
+utildll.dll,TRUE
+userenv.dll,TRUE
+upshared.dll,TRUE
+updatepolicy.dll,TRUE
+uiribbon.dll,TRUE
+uireng.dll,TRUE
+uiautomationcore.dll,TRUE
+uianimation.dll,TRUE
+twinui.appcore.dll,TRUE
+twinapi.dll,TRUE
+twext.dll,TRUE
+ttdrecord.dll,TRUE
+tsworkspace.dll,TRUE
+tquery.dll,TRUE
+timesync.dll,TRUE
+tdh.dll,TRUE
+tbs.dll,TRUE
+tapi32.dll,TRUE
+systemsettingsthresholdadminflowui.dll,TRUE
+sxshared.dll,TRUE
+structuredquery.dll,TRUE
+staterepository.core.dll,TRUE
+ssshim.dll,TRUE
+sspicli.dll,TRUE
+ssp_isv.exe_rsaenh.dll,TRUE
+ssp.exe_rsaenh.dll,TRUE
+srvcli.dll,TRUE
+srpapi.dll,TRUE
+srcore.dll,TRUE
+srclient.dll,TRUE
+sppc.dll,TRUE
+spp.dll,TRUE
+spectrumsyncclient.dll,TRUE
+snmpapi.dll,TRUE
+slc.dll,TRUE
+shell32.dll,TRUE
+secur32.dll,TRUE
+schedcli.dll,TRUE
+scecli.dll,TRUE
+scansetting.dll,TRUE
+sas.dll,TRUE
+sapi_onecore.dll,TRUE
+samlib.dll,TRUE
+samcli.dll,TRUE
+rtworkq.dll,TRUE
+rtutils.dll,TRUE
+rsaenh.dll,TRUE
+rpcnsh.dll,TRUE
+rmclient.dll,TRUE
+resutils.dll,TRUE
+resetengine.dll,TRUE
+reseteng.dll,TRUE
+regapi.dll,TRUE
+reagent.dll,TRUE
+rasmontr.dll,TRUE
+rasman.dll,TRUE
+rasgcw.dll,TRUE
+rasapi32.dll,TRUE
+radcui.dll,TRUE
+puiapi.dll,TRUE
+prvdmofcomp.dll,TRUE
+propsys.dll,TRUE
+printui.dll,TRUE
+polstore.dll,TRUE
+policymanager.dll,TRUE
+pnrpnsp.dll,TRUE
+pla.dll,TRUE
+peerdistsh.dll,TRUE
+pdh.dll,TRUE
+pcaui.dll,TRUE
+p9np.dll,TRUE
+p2pnetsh.dll,TRUE
+p2p.dll,TRUE
+osuninst.dll,TRUE
+osksupport.dll,TRUE
+osbaseln.dll,TRUE
+onex.dll,TRUE
+omadmapi.dll,TRUE
+oleacc.dll,TRUE
+oci.dll,TRUE
+ntshrui.dll,TRUE
+ntmarta.dll,TRUE
+ntlmshared.dll,TRUE
+ntlanman.dll,TRUE
+ntdsapi.dll,TRUE
+nshwfp.dll,TRUE
+nshipsec.dll,TRUE
+nshhttp.dll,TRUE
+npmproxy.dll,TRUE
+nlansp_c.dll,TRUE
+nlaapi.dll,TRUE
+ninput.dll,TRUE
+newdev.dll,TRUE
+networkexplorer.dll,TRUE
+netutils.dll,TRUE
+nettrace.dll,TRUE
+netshell.dll,TRUE
+netsetupapi.dll,TRUE
+netprofm.dll,TRUE
+netplwiz.dll,TRUE
+netiohlp.dll,TRUE
+netid.dll,TRUE
+ndfapi.dll,TRUE
+ncrypt.dll,TRUE
+napinsp.dll,TRUE
+mtxclu.dll,TRUE
+msxml3.dll,TRUE
+mswsock.dll,TRUE
+mswb7.dll,TRUE
+msutb.dll,TRUE
+mstracer.dll,TRUE
+msi.dll,TRUE
+msftedit.dll,TRUE
+msdtctm.dll,TRUE
+msdrm.dll,TRUE
+msctfmonitor.dll,TRUE
+msctf.dll,TRUE
+mscoree.dll,TRUE
+mscms.dll,TRUE
+msacm32.dll,TRUE
+mrmcorer.dll,TRUE
+mpsvc.dll,TRUE
+mprapi.dll,TRUE
+mpr.dll,TRUE
+mpclient.dll,TRUE
+mobilenetworking.dll,TRUE
+mmdevapi.dll,TRUE
+mlang.dll,TRUE
+miutils.dll,TRUE
+mintdh.dll,TRUE
+midimap.dll,TRUE
+mi.dll,TRUE
+mfplat.dll,TRUE
+mfcore.dll,TRUE
+mdmdiagnostics.dll,TRUE
+mapistub.dll,TRUE
+maintenanceui.dll,TRUE
+magnification.dll,TRUE
+lpksetupproxyserv.dll,TRUE
+logoncontroller.dll,TRUE
+logoncli.dll,TRUE
+loadperf.dll,TRUE
+linkinfo.dll,TRUE
+licensingdiagspp.dll,TRUE
+licensemanagerapi.dll,TRUE
+ktmw32.dll,TRUE
+ksuser.dll,TRUE
+kdstub.dll,TRUE
+joinutil.dll,TRUE
+iumbase.dll,TRUE
+isv.exe_rsaenh.dll,TRUE
+iscsium.dll,TRUE
+iscsidsc.dll,TRUE
+iri.dll,TRUE
+iphlpapi.dll,TRUE
+inproclogger.dll,TRUE
+ifmon.dll,TRUE
+iertutil.dll,TRUE
+iedkcs32.dll,TRUE
+ieadvpack.dll,TRUE
+idstore.dll,TRUE
+httpapi.dll,TRUE
+hnetmon.dll,TRUE
+hid.dll,TRUE
+getuname.dll,TRUE
+fxstiff.dll,TRUE
+fxsst.dll,TRUE
+fxsapi.dll,TRUE
+fwpuclnt.dll,TRUE
+fwpolicyiomgr.dll,TRUE
+fwcfg.dll,TRUE
+fwbase.dll,TRUE
+fveapi.dll,TRUE
+fltlib.dll,TRUE
+flightsettings.dll,TRUE
+firewallapi.dll,TRUE
+fhsvcctl.dll,TRUE
+fhcfg.dll,TRUE
+feclient.dll,TRUE
+fddevquery.dll,TRUE
+faultrep.dll,TRUE
+fastprox.dll,TRUE
+explorerframe.dll,TRUE
+execmodelproxy.dll,TRUE
+esent.dll,TRUE
+efsutil.dll,TRUE
+efsadu.dll,TRUE
+edputil.dll,TRUE
+eappprxy.dll,TRUE
+eappcfg.dll,TRUE
+dynamoapi.dll,TRUE
+dxva2.dll,TRUE
+dxgi.dll,TRUE
+dwrite.dll,TRUE
+dwmcore.dll,TRUE
+dwmapi.dll,TRUE
+dusmapi.dll,TRUE
+duser.dll,TRUE
+dui70.dll,TRUE
+dsrole.dll,TRUE
+dsreg.dll,TRUE
+dsparse.dll,TRUE
+dsclient.dll,TRUE
+drprov.dll,TRUE
+dpx.dll,TRUE
+dot3cfg.dll,TRUE
+dot3api.dll,TRUE
+dnsapi.dll,TRUE
+dmxmlhelputils.dll,TRUE
+dmpushproxy.dll,TRUE
+dmprocessxmlfiltered.dll,TRUE
+dmoleaututils.dll,TRUE
+dmiso8601utils.dll,TRUE
+dmenterprisediagnostics.dll,TRUE
+dmenrollengine.dll,TRUE
+dmcmnutils.dll,TRUE
+dmcfgutils.dll,TRUE
+dismcore.dll,TRUE
+dismapi.dll,TRUE
+directmanipulation.dll,TRUE
+dhcpcsvc6.dll,TRUE
+dhcpcsvc.dll,TRUE
+dhcpcmonitor.dll,TRUE
+devrtl.dll,TRUE
+devobj.dll,TRUE
+devicepairing.dll,TRUE
+devicecredential.dll,TRUE
+deviceassociation.dll,TRUE
+desktopshellext.dll,TRUE
+defragproxy.dll,TRUE
+dcomp.dll,TRUE
+dcntel.dll,TRUE
+dbghelp.dll,TRUE
+dbgcore.dll,TRUE
+davclnt.dll,TRUE
+dataexchange.dll,TRUE
+d3dcompiler_47.dll,TRUE
+d3d9.dll,TRUE
+d3d12.dll,TRUE
+d3d11.dll,TRUE
+d3d10warp.dll,TRUE
+d3d10core.dll,TRUE
+d3d10_1core.dll,TRUE
+d3d10_1.dll,TRUE
+d3d10.dll,TRUE
+d2d1.dll,TRUE
+cscui.dll,TRUE
+cscobj.dll,TRUE
+cscapi.dll,TRUE
+cryptxml.dll,TRUE
+cryptui.dll,TRUE
+cryptdll.dll,TRUE
+cryptbase.dll,TRUE
+credui.dll,TRUE
+coremessaging.dll,TRUE
+connect.dll,TRUE
+comdlg32.dll,TRUE
+colorui.dll,TRUE
+coloradapterclient.dll,TRUE
+cmpbk32.dll,TRUE
+clusapi.dll,TRUE
+clipc.dll,TRUE
+cldapi.dll,TRUE
+certenroll.dll,TRUE
+cabview.dll,TRUE
+cabinet.dll,TRUE
+bootmenuux.dll,TRUE
+bderepair.dll,TRUE
+bcrypt.dll,TRUE
+bcp47mrm.dll,TRUE
+bcp47langs.dll,TRUE
+bcd.dll,TRUE
+avrt.dll,TRUE
+authz.dll,TRUE
+authfwcfg.dll,TRUE
+auditpolcore.dll,TRUE
+audioses.dll,TRUE
+atl.dll,TRUE
+archiveint.dll,TRUE
+appxdeploymentclient.dll,TRUE
+appxalluserstore.dll,TRUE
+applicationframe.dll,TRUE
+apphelp.dll,TRUE
+aepic.dll,TRUE
+adsldpc.dll,TRUE
+activeds.dll,TRUE
\ No newline at end of file
diff --git a/lookups/hijacklibs.yml b/lookups/hijacklibs.yml
new file mode 100644
index 0000000000..8ca1473e26
--- /dev/null
+++ b/lookups/hijacklibs.yml
@@ -0,0 +1,7 @@
+description: A list of potentially abused libraries in Windows
+filename: hijacklibs.csv
+name: hijacklibs
+default_match: 'false'
+match_type: WILDCARD(attacker_tool_names)
+min_matches: 1
+case_sensitive_match: 'false'
\ No newline at end of file