Techniques › T1129
T1129 Shared Modules
execution — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
2
Sigma rules tagged attack.t1129
0
KEV CVEs mapped here
<p>Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API).</p><p>Adversaries may use this functionality as a way to execute arbitrary payloads on a victim system. For example, adversaries can modularize functionality of their malware into shared objects that perform various functions such as managing C2 network communications or execution of specific actions on objective.</p><p>The Linux & macOS module loader can load and execute shared objects from arbitrary local paths. This functionality resides in
dlfcn.h in functions such as dlopen and dlsym. Although macOS can execute .so files, common practice uses .dylib files.</p><p>The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like LoadLibrary at run time.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0018 Behavior-chain, platform-aware detection strategy for T1129 Shared Modules v1.0
AN0052 WindowsA process (often LOLBin or user-launched program) loads a DLL from a user-writable/UNC/Temp path or unsigned/invalid signer. Within a short window the DLL is (a) newly written to disk, (b) spawned as follow-on execution (rundll32/regsvr32), or (c) establishes outbound C2.WinEventLog:Microsoft-Windows-CodeIntegrity/Operational
CodeIntegrity/WDAC events indicating unsigned/invalid DLL loads→ DC0034 Process MetadataTunable:TimeWindowSuspiciousPathRegexUnsignedOnlyRareSignerThresholdMinFileSizeKBAN0053 LinuxA process loads a shared object (.so) via dlopen/LD_PRELOAD/open from non-standard or temporary locations (e.g., /tmp, /dev/shm), especially shortly after that .so is written or fetched, or linked via manipulated environment variables (LD_PRELOAD/LD_LIBRARY_PATH).auditd:EXECVEexecve: Processes launched with LD_PRELOAD/LD_LIBRARY_PATH pointing to non-system dirs→ DC0032 Process Creationlinux:syslogsudo or service accounts invoking loaders with suspicious env vars→ DC0034 Process MetadataNSM:Flowhttp/file-xfer: Inbound/outbound transfer of ELF shared objects→ DC0085 Network Traffic ContentTunable:SuspiciousDirsTimeWindowEnvVarWatchlistAllowedSigning/HashListAN0054 macOSA process loads a non-system .dylib/.so via dyld (dlopen/dlsym) from user-writable locations (~/Library, /tmp) or after the library was recently created/downloaded, often followed by network egress or persistence.macos:unifiedlogdyld/unified log entries indicating image load from non-system paths→ DC0016 Module Loadmacos:endpointsecurityexec: Process execution context for loaders calling dlopen/dlsym→ DC0032 Process Creationmacos:endpointsecurityES_EVENT_TYPE_NOTIFY_OPEN: Open of .dylib/.so in user-writable locations→ DC0055 File AccessTunable:SuspiciousDirsUnsignedOnlyTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1129
Author: Jonathan Beierle (@hullabrian)
· 2025-11-22 · logsource: product=windows category=image_load · e5f5c693-52d7-4de5-88ae-afbfbce85595
Detects the loading of unsigned .node files.
Adversaries may abuse a lack of .node integrity checking to execute arbitrary code inside of trusted applications such as Slack.
.node files are native add-ons for Electron-based applications, which are commonly used for desktop applications like Slack, Discord, and Visual Studio Code.
This technique has been observed in the DripLoader malware, which uses unsigned .node files to load malicious native code into Electron applications.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-22 · logsource: product=windows category=image_load · e6c7ab7c-c79d-4b84-b913-b2ec3f8e8a98
Detects loading of DLLs associated with Katz Stealer malware 2025 variants.
Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems.
The process that loads these DLLs are very likely to be malicious.