kevmap

TechniquesT1129 › AN0053

AN0053 Analytic 0053

Linux · attack.mitre.org · ATT&CK Enterprise v19.2

<p>A process loads a shared object (.so) via dlopen/LD_PRELOAD/open from non-standard or temporary locations (e.g., /tmp, /dev/shm), especially shortly after that .so is written or fetched, or linked via manipulated environment variables (LD_PRELOAD/LD_LIBRARY_PATH).</p>
Detects
T1129 Shared Modules
Part of
DET0018 Behavior-chain, platform-aware detection strategy for T1129 Shared Modules

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
auditd:SYSCALLopenat/read/mmap: Open/mmap .so files from non-standard pathsDC0016 Module Load
auditd:EXECVEexecve: Processes launched with LD_PRELOAD/LD_LIBRARY_PATH pointing to non-system dirsDC0032 Process Creation
linux:syslogsudo or service accounts invoking loaders with suspicious env varsDC0034 Process Metadata
NSM:Flowhttp/file-xfer: Inbound/outbound transfer of ELF shared objectsDC0085 Network Traffic Content

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
SuspiciousDirs(/tmp, /dev/shm, /var/tmp, user home dirs) – adjust to your environment.
TimeWindowCorrelate write/fetch of .so to its load (e.g., 0–30 minutes).
EnvVarWatchlistLD_PRELOAD, LD_LIBRARY_PATH, LD_AUDIT.
AllowedSigning/HashListKnown-good signed or hashed shared objects.