T1574.006 — Dynamic Linker Hijacking

Tactics: Stealth, Execution · Platforms: Linux, macOS

Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from various environment variables…

Sub-technique of Hijack Execution Flow (T1574).

Sigma detection rules (2)

T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking

title: "T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking"
id: d77697b1-2bfc-4f7a-a364-4186e1b71629
description: 'Detection Strategy for Hijack Execution Flow: Dynamic Linker Hijacking. Extended beyond the single /etc/ld.so.preload watch to also cover /etc/ld.so.conf.d/ (a documented gap for malicious library-path additions) and the common shell-profile/systemd unit files (/etc/environment, /etc/profile, /etc/profile.d/, /etc/security/pam_env.conf, /etc/systemd/system/) that adversaries can use to set LD_PRELOAD persistently outside the transient per-process env-var path auditd cannot see without dedicated environment-capture configuration. (Retargeted to the file_change auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: WatchedEnvVars, MonitoredDirectories, CorrelationWindow.'
references:
  - https://attack.mitre.org/techniques/T1574/006
author: Shahrukh Khan
date: 2026-01-08
license: MIT
tags:
  - attack.stealth
  - attack.execution
  - attack.t1574.006

logsource:
  category: file_change
  product: linux

detection:
  selection_preload_file:
    type: PATH
    nametype: NORMAL
    name: '/etc/ld.so.preload'
  selection_ld_conf_d:
    type: PATH
    nametype:
      - CREATE
      - NORMAL
    name|startswith: '/etc/ld.so.conf.d/'
  selection_env_files_exact:
    type: PATH
    nametype: NORMAL
    name:
      - '/etc/environment'
      - '/etc/profile'
      - '/etc/security/pam_env.conf'
  selection_env_files_prefix:
    type: PATH
    nametype: NORMAL
    name|startswith:
      - '/etc/profile.d/'
      - '/etc/systemd/system/'

  condition: 1 of selection_*

falsepositives:
  - Standard auditd EXECVE records do not capture the process environment block by default, so a transient LD_PRELOAD set only in a running process environment (not written to any of the watched files) remains invisible unless auditctl environment-capture is separately enabled at the kernel/auditd config level; this rule now covers the persistent file-based variants only.
  - Legitimate package management (ldconfig re-runs, apt/dpkg triggers) and routine system administration modify /etc/ld.so.conf.d/ and profile/systemd files; investigate the actual content change rather than alerting on the touch event alone.

level: high

T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking

title: "T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking"
id: 85002135-6e6c-4808-af9f-e5e388db943f
description: 'Detection Strategy for Hijack Execution Flow: Dynamic Linker Hijacking. (Retargeted to the file_change macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: WatchedEnvVars, BaselineDylibs, MonitoredDirectories.'
references:
  - https://attack.mitre.org/techniques/T1574/006
author: Shahrukh Khan
date: 2026-03-10
license: MIT
tags:
  - attack.stealth
  - attack.execution
  - attack.t1574.006

logsource:
  category: file_change
  product: macos

detection:
  selection:
    TargetFilename|endswith:
      - '/.bash_profile'
      - '/.zshenv'
      - '/.zprofile'

  condition: selection

falsepositives:
  - file_change telemetry only shows that a shell profile file was modified, not whether it now sets DYLD_INSERT_LIBRARIES, so legitimate user customization of the shell environment produces identical events.

level: medium

Related sub-techniques

Explore