T1129 — Shared Modules

Tactic: Execution · Platforms: Linux, macOS, Windows

Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API). Adversaries may use this functionality as…

Sigma detection rules (3)

T1129 Shared Modules

title: T1129 Shared Modules
id: 96ddb1bf-452b-450a-88f9-408351ed2703
description: 'Detects unsigned DLLs loaded from user-writable/non-standard paths (Temp, AppData, Downloads, Public, ProgramData), the concrete combination that distinguishes malicious shared-module loading from routine DLL loads. (Data Component: Module Load; baseline tier: windows-eventid.) Tune using: TimeWindow, SuspiciousPathRegex, UnsignedOnly, RareSignerThreshold, MinFileSizeKB.'
references:
  - https://attack.mitre.org/techniques/T1129
author: Shahrukh Khan
date: 2026-03-25
license: MIT
tags:
  - attack.execution
  - attack.t1129

logsource:
  category: image_load
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '7'

  selection_suspicious_path:
    ImageLoaded|contains:
      - '\Temp\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Downloads\'
      - '\Users\Public\'
      - '\ProgramData\'

  selection_unsigned:
    Signed: 'false'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and selection_suspicious_path and selection_unsigned and not filter_system_account

falsepositives:
  - Legitimate unsigned third-party tools or dev/test builds run from a user profile directory.

level: medium

T1129 Shared Modules

title: T1129 Shared Modules
id: ed5648f0-a918-4fb4-963f-11784a9c029c
description: 'Behavior-chain, platform-aware detection strategy for T1129 Shared Modules. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Dropped the argv-based LD_PRELOAD selection: LD_PRELOAD is set as a process environment variable, never passed as an argv token, so auditd EXECVE records (which capture argv, not environment) never contain it and that branch was dead logic. Detection now relies solely on the /etc/ld.so.preload PATH watch as the primary signal. Tune using: SuspiciousDirs, TimeWindow, AllowedSigning/HashList.'
references:
  - https://attack.mitre.org/techniques/T1129
author: Shahrukh Khan
date: 2026-02-11
license: MIT
tags:
  - attack.execution
  - attack.t1129

logsource:
  category: process_creation
  product: linux

detection:
  selection_file:
    type: PATH
    name: '/etc/ld.so.preload'
    nametype: NORMAL
  condition: selection_file

falsepositives:
  - auditd''s raw syscall/mmap visibility into shared-library loading is weak, so this proxies via the preload config file rather than direct module-load telemetry; confirm the underlying audit watch rule on /etc/ld.so.preload is armed for write/attribute-change access (e.g. -p wa) rather than reads, since the dynamic linker consults this file at process start and a read-armed watch would fire near-constantly.

level: high

T1129 Shared Modules

title: T1129 Shared Modules
id: 6e72f4e7-9c97-4a55-a43c-5f6b4437ef13
description: 'Behavior-chain, platform-aware detection strategy for T1129 Shared Modules. (Retargeted to the image_load macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SuspiciousDirs, UnsignedOnly, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1129
author: Shahrukh Khan
date: 2026-01-25
license: MIT
tags:
  - attack.execution
  - attack.t1129

logsource:
  category: image_load
  product: macos

detection:
  selection:
    ImageLoaded|contains:
      - '/tmp/'
      - '/private/tmp/'
      - '/Users/Shared/'

  condition: selection

falsepositives:
  - Rare; some development or debugging workflows may load dylibs from temp directories intentionally.

level: high

Explore