Techniques › T1129 › AN0053
AN0053 Analytic 0053
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>A process loads a shared object (.so) via dlopen/LD_PRELOAD/open from non-standard or temporary locations (e.g., /tmp, /dev/shm), especially shortly after that .so is written or fetched, or linked via manipulated environment variables (LD_PRELOAD/LD_LIBRARY_PATH).</p>
- Detects
- T1129 Shared Modules
- Part of
- DET0018 Behavior-chain, platform-aware detection strategy for T1129 Shared Modules
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | openat/read/mmap: Open/mmap .so files from non-standard paths | DC0016 Module Load |
| auditd:EXECVE | execve: Processes launched with LD_PRELOAD/LD_LIBRARY_PATH pointing to non-system dirs | DC0032 Process Creation |
| linux:syslog | sudo or service accounts invoking loaders with suspicious env vars | DC0034 Process Metadata |
| NSM:Flow | http/file-xfer: Inbound/outbound transfer of ELF shared objects | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
SuspiciousDirs | (/tmp, /dev/shm, /var/tmp, user home dirs) – adjust to your environment. |
TimeWindow | Correlate write/fetch of .so to its load (e.g., 0–30 minutes). |
EnvVarWatchlist | LD_PRELOAD, LD_LIBRARY_PATH, LD_AUDIT. |
AllowedSigning/HashList | Known-good signed or hashed shared objects. |