Cross-source coverage

T1574.006 / ATT&CK

Hijack Execution Flow: Dynamic Linker Hijacking

30 rules across 5 sources.

Showing deprecated rules · back to the default

From MITRE ATT&CK 19.2

Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from various environment variables and files, such as LD_PRELOAD on Linux or DYLD_INSERT_LIBRARIES on macOS. Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name. Each platform's linker uses an extensive list of environment variables at different points in execution. These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions in the original library.

Hijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges. On Linux, adversaries may set LD_PRELOAD to point to malicious libraries that match the name of legitimate libraries which are requested by a victim program, causing the operating system to load the adversary's malicious code upon execution of the victim program. For example, adversaries have used LD_PRELOAD to inject a malicious library into every descendant process of the sshd daemon, resulting in execution under a legitimate process. When the executing sub-process calls the execve function, for example, the malicious library’s execve function is executed rather than the system function execve contained in the system library on disk. This allows adversaries to Hide Artifacts from detection, as hooking system functions such as execve and readdir enables malware to scrub its own artifacts from the results of commands such as ls, ldd, iptables, and dmesg.

Hijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges.

Tactics: Stealth · Execution
Platforms: Linux · macOS
Telemetry: auditd:SYSCALLauditd:PATHlinux:osquerymacos:unifiedlog

How MITRE says to detect it DET0435

Detection Strategy for Hijack Execution Flow: Dynamic Linker Hijacking

Linux Analytic 1209

Detection focuses on identifying abuse of LD_PRELOAD and related linker variables. Defender perspective: monitor unexpected setting or modification of LD_PRELOAD in shell initialization scripts or environment exports, file creation of suspicious shared libraries, and correlation of these modifications with anomalous process execution. Key signals include execve events with LD_PRELOAD defined, newly created.so files in user directories, and processes hooking libc functions exhibiting abnormal behavior.

auditd:SYSCALL execve with LD_PRELOAD or linker-related environment variables set
auditd:PATH creation of .so files in non-standard directories (e.g., /tmp, /home/*)
linux:osquery process environment variables containing LD_PRELOAD

macOS Analytic 1210

Detection centers on DYLD_INSERT_LIBRARIES and DYLD_LIBRARY_PATH abuse. Defender perspective: monitor for modification of these environment variables in shell or plist files, file creation of dylibs in user-controlled paths, and correlation of environment variable usage with unexpected module loads by user applications. Suspicious indicators include processes with DYLD_INSERT_LIBRARIES set, execution of applications loading untrusted dylibs, and anomalies in module load history.

macos:unifiedlog execution of process with DYLD_INSERT_LIBRARIES set
macos:unifiedlog create/modify dylib in monitored directories
macos:unifiedlog loading of unexpected dylibs compared to historical baselines

View on attack.mitre.org ↗

elastic/detection-rules

19 rules

Detection	Severity	Format
Dylib Injection via Process Environment Variables	High	Elastic TOML
Dynamic Linker Copy	High	Elastic TOML
Dynamic Linker Modification Detected via Defend for Containers	High	Elastic TOML
Potential CVE-2025-32463 Nsswitch File Creation	High	Elastic TOML
Potential Privilege Escalation via PKEXEC	High	Elastic TOML
Suspicious Dynamic Linker Discovery via od	High	Elastic TOML
Suspicious Echo or Printf Execution Detected via Defend for Containers	High	Elastic TOML
Unusual LD_PRELOAD/LD_LIBRARY_PATH Command Line Arguments	High	Elastic TOML
Deprecated - Suspicious File Creation in /etc for Persistence	Medium	Elastic TOML
Dynamic Linker Creation	Medium	Elastic TOML

+ 9 more from elastic/detection-rules → showing the 10 highest-severity

splunk/security_content

5 rules

Detection	Severity	Format
GitHub Workflow File Creation or Modification	Undefined	SPL
Linux Auditd Preload Hijack Library Calls	Undefined	SPL
Linux Auditd Preload Hijack Via Preload File	Undefined	SPL
Linux Preload Hijack Library Calls	Undefined	SPL
Shai-Hulud Workflow File Creation or Modification	Undefined	SPL

SigmaHQ/sigma

2 rules

Detection	Severity	Format
Code Injection by ld.so Preload	High	Sigma
Modification of ld.so.preload	High	Sigma

elastic/protections-artifacts

2 rules

Detection	Severity	Format
Shared Object File Creation and Immediate Preload	Undefined	Elastic TOML
Shared Object Injection via Process Environment Variable	Undefined	Elastic TOML

socfortress/Wazuh-Rules

2 rules

Detection	Severity	Format
Potential LD_PRELOAD hijack detected (T1574.006)	High	Wazuh XML
Write attempt to /etc/ld.so.preload (T1574.006)	High	Wazuh XML