Techniques › T1574 › T1574.004
T1574.004 Dylib Hijacking
stealth · execution — macOS · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
0
Sigma rules tagged attack.t1574.004
0
KEV CVEs mapped here
<p>Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an expected name in a path a victim application searches at runtime. The dynamic loader will try to find the dylibs based on the sequential order of the search paths. Paths to dylibs may be prefixed with <code>@rpath</code>, which allows developers to use relative paths to specify an array of search paths used at runtime based on the location of the executable. Additionally, if weak linking is used, such as the <code>LC_LOAD_WEAK_DYLIB</code> function, an application will still execute even if an expected dylib is not present. Weak linking enables developers to run an application on multiple macOS versions as new APIs are added.</p><p>Adversaries may gain execution by inserting malicious dylibs with the name of the missing dylib in the identified path. Dylibs are loaded into an application's address space allowing the malicious dylib to inherit the application's privilege level and resources. Based on the application, this could result in privilege escalation and uninhibited network access. This method may also evade detection from security products since the execution is masked under a legitimate process.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0152 Detection Strategy for Hijack Execution Flow: Dylib Hijacking v1.0
AN0435 macOSDetection focuses on adversaries placing or modifying malicious dylibs in locations searched by legitimate applications. From the defender’s perspective, observable patterns include unexpected creation or modification of dylib files in application bundle paths, unusual module loads by processes compared to historical baselines, and execution of applications loading dylibs from suspicious directories (e.g., /tmp, user-controlled paths). Correlation across file system changes, process execution, and module loads provides high-fidelity detection.Tunable:
MonitoredDirectoriesBaselineDylibsCorrelationWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1574.004
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1574) 8
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: FPT.EagleEye, Thomas Patzke (improvements)
· 2021-06-29 (modified 2022-06-02) · logsource: product=windows category=image_load · 02fb90de-c321-4e63-a6b9-25f4b03dfd14
Detect DLL Load from Spooler Service backup folder. This behavior has been observed during the exploitation of the Print Spooler Vulnerability CVE-2021-1675 and CVE-2021-34527 (PrinterNightmare).
Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
· 2019-11-15 (modified 2021-11-27) · logsource: product=windows category=process_creation · 1c373b6d-76ce-4553-997d-8c1da9a6b5f5
Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378
Author: Florian Roth (Nextron Systems)
· 2019-07-17 (modified 2023-05-24) · logsource: product=windows category=process_creation · 50919691-7302-437f-8e10-1fe088afa145
Detects a "regsvr32" execution where the DLL doesn't contain a common file extension.
Author: Bhabesh Raj
· 2021-07-01 (modified 2023-02-17) · logsource: product=windows category=file_delete · 5b2bbc47-dead-4ef7-8908-0cf73fcbecbf
Detect DLL deletions from Spooler Service driver folder. This might be a potential exploitation attempt of CVE-2021-1675
Author: frack113
· 2022-08-07 (modified 2023-08-17) · logsource: product=windows category=registry_set · 9827ae57-3802-418f-994b-d5ecf5cd974b
Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will get invoked when an application crashes
Author: Ivan Dyachkov, Yulia Fomina, oscd.community
· 2020-10-07 (modified 2021-11-27) · logsource: product=windows category=process_creation · a2910908-e86f-4687-aeba-76a5f996e652
Detects using register-cimprovider.exe to execute arbitrary dll file.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-21 · logsource: product=windows category=file_event · dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c
Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.
Author: Florian Roth (Nextron Systems)
· 2020-07-01 (modified 2023-08-17) · logsource: product=windows category=registry_set · e0813366-0407-449a-9869-a2db1119dc41
Detects a suspicious printer driver installation with an empty Manufacturer value