T1574.004 — Dylib Hijacking

Tactics: Stealth, Execution · Platforms: macOS

Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an expected name in a path a victim application searches at runtime. The dynamic loader will try to find the dylibs based on the sequential order of the search paths. Paths to dylibs may be prefixed with…

Sub-technique of Hijack Execution Flow (T1574).

Sigma detection rules (1)

T1574.004 Hijack Execution Flow: Dylib Hijacking

title: "T1574.004 Hijack Execution Flow: Dylib Hijacking"
id: f8b792e9-79aa-44f7-b4ab-3ee1c2d011b0
description: 'Detection Strategy for Hijack Execution Flow: Dylib Hijacking. (Retargeted to the file_event macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MonitoredDirectories, BaselineDylibs, CorrelationWindow.'
references:
  - https://attack.mitre.org/techniques/T1574/004
author: Shahrukh Khan
date: 2026-06-24
license: MIT
tags:
  - attack.stealth
  - attack.execution
  - attack.t1574.004

logsource:
  category: file_event
  product: macos

detection:
  selection:
    TargetFilename|endswith: '.dylib'
    TargetFilename|contains: '/Contents/Frameworks/'

  condition: selection

falsepositives:
  - Legitimate application updates or plugin installers routinely drop new dylib files into an apps Frameworks directory during normal upgrades.

level: high

Related sub-techniques

Explore