T1546.006 — LC_LOAD_DYLIB Addition

Tactics: Privilege Escalation, Persistence · Platforms: macOS

Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries. Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded. The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which…

Sub-technique of Event Triggered Execution (T1546).

Sigma detection rules (1)

T1546.006 Event Triggered Execution: LC_LOAD_DYLIB Addition

title: "T1546.006 Event Triggered Execution: LC_LOAD_DYLIB Addition"
id: c397488a-1c34-4bc0-9dfc-a1a21d1e070f
description: 'Detection Strategy for LC_LOAD_DYLIB Modification in Mach-O Binaries on macOS. (Retargeted to the file_change macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimeWindow, DylibPathRegex, UnsignedDylibThreshold, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1546/006
author: Shahrukh Khan
date: 2026-04-09
license: MIT
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.006

logsource:
  category: file_change
  product: macos

detection:
  selection:
    TargetFilename|contains: '.app/Contents/MacOS/'
  condition: selection

falsepositives:
  - Detecting an added LC_LOAD_DYLIB load command inside a Mach-O binary requires inspecting the binary header itself, which is not represented as a discrete unified log field, so this file_change based approximation only flags that the executable inside an application bundle was modified and will produce noise from legitimate in-place app updates.

level: high

Related sub-techniques

Explore