Why can using xwizard.exe for DLL loading help bypass application whitelisting?

xwizard.exe is a Microsoft-signed binary, so it is often allowed by application whitelist controls. By exploiting the DLL search order to load a malicious `xwizards.dll` from a different folder, an attacker can execute arbitrary code while the signed process maintains trust. This method complements other white list bypass techniques like [using tracker.exe to load a DLL](/news/study-notes-weekly-no-4-use-tracker-to-load-dll-use-csi-to-bypass-umci-execute-c-from-xslt-file).