Cross-source coverage

T1129 / ATT&CK

Shared Modules

30 rules across 6 sources.

Showing deprecated rules · back to the default

From MITRE ATT&CK 19.2

Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API).

Adversaries may use this functionality as a way to execute arbitrary payloads on a victim system. For example, adversaries can modularize functionality of their malware into shared objects that perform various functions such as managing C2 network communications or execution of specific actions on objective.

The Linux & macOS module loader can load and execute shared objects from arbitrary local paths. This functionality resides in dlfcn.h in functions such as dlopen and dlsym. Although macOS can execute .so files, common practice uses .dylib files.

The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like LoadLibrary at run time.

Tactics
Execution
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SysmonWinEventLog:SecurityWinEventLog:Microsoft-Windows-CodeIntegrity/Operationalauditd:SYSCALLauditd:EXECVElinux:syslogNSM:Flowmacos:unifiedlogmacos:endpointsecurity

How MITRE says to detect it DET0018

Behavior-chain, platform-aware detection strategy for T1129 Shared Modules

Windows Analytic 0052

A process (often LOLBin or user-launched program) loads a DLL from a user-writable/UNC/Temp path or unsigned/invalid signer. Within a short window the DLL is (a) newly written to disk, (b) spawned as follow-on execution (rundll32/regsvr32), or (c) establishes outbound C2.

  • WinEventLog:Sysmon EventCode=7
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Security EventCode=4688
  • WinEventLog:Sysmon EventCode=3, 22
  • WinEventLog:Microsoft-Windows-CodeIntegrity/Operational CodeIntegrity/WDAC events indicating unsigned/invalid DLL loads

Linux Analytic 0053

A process loads a shared object (.so) via dlopen/LD_PRELOAD/open from non-standard or temporary locations (e.g., /tmp, /dev/shm), especially shortly after that.so is written or fetched, or linked via manipulated environment variables (LD_PRELOAD/LD_LIBRARY_PATH).

  • auditd:SYSCALL openat/read/mmap: Open/mmap .so files from non-standard paths
  • auditd:EXECVE execve: Processes launched with LD_PRELOAD/LD_LIBRARY_PATH pointing to non-system dirs
  • linux:syslog sudo or service accounts invoking loaders with suspicious env vars
  • NSM:Flow http/file-xfer: Inbound/outbound transfer of ELF shared objects

macOS Analytic 0054

A process loads a non-system.dylib/.so via dyld (dlopen/dlsym) from user-writable locations (~/Library, /tmp) or after the library was recently created/downloaded, often followed by network egress or persistence.

  • macos:unifiedlog dyld/unified log entries indicating image load from non-system paths
  • macos:endpointsecurity exec: Process execution context for loaders calling dlopen/dlsym
  • macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_OPEN: Open of .dylib/.so in user-writable locations

View on attack.mitre.org ↗

elastic/detection-rules

8 rules
Detection Severity Format
Suspicious Execution from Foomatic-rip or Cupsd Parent High Elastic TOML
Suspicious SolarWinds Web Help Desk Java Module Load or Child Process High Elastic TOML
Unusual Library Load via Python High Elastic TOML
WPS Office Exploitation via DLL Hijack High Elastic TOML
Execution via local SxS Shared Module Medium Elastic TOML
ImageLoad via Windows Update Auto Update Client Medium Elastic TOML
Suspicious Execution via Microsoft Office Add-Ins Medium Elastic TOML
Unsigned DLL loaded by DNS Service Medium Elastic TOML

chronicle/detection-rules

6 rules
Detection Severity Format
sap_sensitive_rfc_function_module_execution High YARA-L
sap_function_module_testing_detected Medium YARA-L
a_variant_of_data_stealer_trojan_activity Undefined YARA-L
covid19_phishing_campaign_fake_world_health_organization Undefined YARA-L
mshta_downloads_malware_by_using_covid19_themed_document Undefined YARA-L
turla_scheduled_task_and_host_fingerprinting_detector_sysmon_behavior Undefined YARA-L

splunk/security_content

6 rules
Detection Severity Format
Linux Suspicious GCC Invocation Building Init Shared Object Undefined SPL
Windows Executable in Loaded Modules Undefined SPL
Windows PowerShell Module File Created Undefined SPL
Windows PowerShell Script TabExpansion Direct Call Undefined SPL
Windows Remote Image Load Undefined SPL
Windows XLL File Creation Outside of Typical Location Undefined SPL

elastic/protections-artifacts

5 rules
Detection Severity Format
Creation of Hidden Shared Object File Undefined Elastic TOML
Potential Privilege Escalation via DLL Redirection Undefined Elastic TOML
Suspicious Dylib Load from Temporary Directory Undefined Elastic TOML
UAC Bypass Attempt via Consent DLL Search Order Hijacking Undefined Elastic TOML
UAC Bypass Attempt via DCCW DLL Search Order Hijacking Undefined Elastic TOML

socfortress/Wazuh-Rules

3 rules
Detection Severity Format
Sysmon - Event 1: Process creation · Install VIB via plink.exe (T1129) High Wazuh XML
Sysmon - Event 1: Process creation · Load Component via pscp.exe (T1129) High Wazuh XML
Sysmon - Event 1: Process creation · Remove VIB via plink.exe (T1129) High Wazuh XML

SigmaHQ/sigma

2 rules
Detection Severity Format
Katz Stealer DLL Loaded High Sigma
Unsigned .node File Loaded Medium Sigma

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.