Techniques › T1574.004 › AN0435
AN0435 Analytic 0435
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection focuses on adversaries placing or modifying malicious dylibs in locations searched by legitimate applications. From the defender’s perspective, observable patterns include unexpected creation or modification of dylib files in application bundle paths, unusual module loads by processes compared to historical baselines, and execution of applications loading dylibs from suspicious directories (e.g., /tmp, user-controlled paths). Correlation across file system changes, process execution, and module loads provides high-fidelity detection.</p>
- Detects
- T1574.004 Dylib Hijacking
- Part of
- DET0152 Detection Strategy for Hijack Execution Flow: Dylib Hijacking
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | process execution events with dylib load activity | DC0016 Module Load |
| macos:unifiedlog | create/modify dylib files in monitored directories | DC0039 File Creation |
| macos:unifiedlog | replace existing dylibs | DC0061 File Modification |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
MonitoredDirectories | Application bundle directories (e.g., /Applications/*/Contents/MacOS, /Library/Frameworks). Adversaries may use non-standard paths like /tmp. |
BaselineDylibs | Historical record of dylibs typically loaded by applications. Deviations should be flagged. |
CorrelationWindow | Timeframe to correlate dylib file modification with subsequent process execution and module loads. |