tfMITRE ATT&CK technique

Shared Modules T1129

Tactic: Execution
Platforms: Linux, macOS, Windows
Version: 2.3
Created: 31 May 2017
Last modified: 24 October 2025
Contributor: Stefan Kanthak

Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API).

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 17%

Tools & malware83rd percentile · 82% of ATT&CK techniques have fewer tools implementing them.

Detection rules72nd pct

Detection rules72nd percentile · 69% of ATT&CK techniques have fewer detection rules written.

tfMITRE ATT&CK technique

Shared Modules T1129

Tactic: Execution
Platforms: Linux, macOS, Windows
Version: 2.3
Created: 31 May 2017
Last modified: 24 October 2025
Contributor: Stefan Kanthak

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 17%

Tools & malware83rd percentile · 82% of ATT&CK techniques have fewer tools implementing them.

Detection rules72nd pct

Detection rules72nd percentile · 69% of ATT&CK techniques have fewer detection rules written.

Shared Modules MITRE reference T1129

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Mustang PandaG0129 ↗

Has leveraged LoadLibrary to load DLLs.1

created 2021-04-121 referenceaka TA416

All 1 groups for this technique

21 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

LightSpyS1185 ↗

LightSpy's main executable and module .dylib binaries are loaded using a combination of dlopen() to load the library, _objc_getClass() to retrieve the class definition, and _objec_msgSend() to invoke/execute the specified method in the loaded class.1

created 2025-01-03MALWAREcarried by 1 group

VersaMemS1154 ↗

Relied on the Java Instrumentation API and Javassist to dynamically modify Java code existing in memory.1

created 2024-08-27MALWAREcarried by 1 group

RotaJakiroS1078 ↗

Uses dynamically linked shared libraries (.so files) to execute additional functionality using dlopen() and dlsym().1

created 2023-06-14MALWAREcarried by 1 group

BumblebeeS1039 ↗

Can use LoadLibrary to attempt to execute GdiPlus.dll.1

created 2022-08-19MALWAREcarried by 2 groups

DarkWatchmanS0673 ↗

Can load DLLs.1

created 2022-01-10MALWARE

FoggyWebS0661 ↗

FoggyWeb's loader can call the load() function to load the FoggyWeb dll into an Application Domain on a compromised AD FS server.1

created 2021-11-16MALWAREcarried by 1 group

All 21 software entries for this technique · 6 newest in this preview

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Process MetadataDC0034	WinEventLog:Microsoft-Windows-CodeIntegrity/Operational	CodeIntegrity/WDAC events indicating unsigned/invalid DLL loads
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Data component

Name

Channel

Module LoadDC0016

WinEventLog:Sysmon

EventCode=7

Process CreationDC0032

WinEventLog:Security

EventCode=4688

Process MetadataDC0034

WinEventLog:Microsoft-Windows-CodeIntegrity/Operational

CodeIntegrity/WDAC events indicating unsigned/invalid DLL loads

File CreationDC0039

WinEventLog:Sysmon

EventCode=11

Network Connection CreationDC0082

WinEventLog:Sysmon

EventCode=3, 22

Field	What you tune
TimeWindow	Correlation window between file write → module load → network (e.g., 0–20 minutes).
SuspiciousPathRegex	Regex for user-writable/UNC/temp paths to flag (e.g., %TEMP%, %APPDATA%, \\*\share\).
UnsignedOnly	Alert only when SignatureStatus != Valid to reduce noise.
RareSignerThreshold	Frequency threshold for unseen/rare signers in last N days.
MinFileSizeKB	Ignore tiny DLL stubs to cut noise.

Field

What you tune

TimeWindow

Correlation window between file write → module load → network (e.g., 0–20 minutes).

SuspiciousPathRegex

Regex for user-writable/UNC/temp paths to flag (e.g., %TEMP%, %APPDATA%, \\*\share\).

UnsignedOnly

Alert only when SignatureStatus != Valid to reduce noise.

RareSignerThreshold

Frequency threshold for unseen/rare signers in last N days.

MinFileSizeKB

Ignore tiny DLL stubs to cut noise.

Data component	Name	Channel
Module LoadDC0016	auditd:SYSCALL	openat/read/mmap: Open/mmap .so files from non-standard paths
Process CreationDC0032	auditd:EXECVE	execve: Processes launched with LD_PRELOAD/LD_LIBRARY_PATH pointing to non-system dirs
Process MetadataDC0034	linux:syslog	sudo or service accounts invoking loaders with suspicious env vars
Network Traffic ContentDC0085	NSM:Flow	http/file-xfer: Inbound/outbound transfer of ELF shared objects

Field	What you tune
SuspiciousDirs	(/tmp, /dev/shm, /var/tmp, user home dirs) – adjust to your environment.
TimeWindow	Correlate write/fetch of .so to its load (e.g., 0–30 minutes).
EnvVarWatchlist	LD_PRELOAD, LD_LIBRARY_PATH, LD_AUDIT.
AllowedSigning/HashList	Known-good signed or hashed shared objects.

Data component	Name	Channel
Module LoadDC0016	macos:unifiedlog	dyld/unified log entries indicating image load from non-system paths
Process CreationDC0032	macos:endpointsecurity	exec: Process execution context for loaders calling dlopen/dlsym
File AccessDC0055	macos:endpointsecurity	ES_EVENT_TYPE_NOTIFY_OPEN: Open of .dylib/.so in user-writable locations

Field	What you tune
SuspiciousDirs	~/Library, /tmp, /Users//. (hidden dirs) – tune to enterprise layout.
UnsignedOnly	Alert only when code-signing is invalid or absent.
TimeWindow	Correlate write/open to module load within N minutes.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects loading of DLLs associated with Katz Stealer malware 2025 variants. (...)	Emerging	experimental	image_load	windows	Sysmon	Execution Shared Modules	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-05-22	—	e6c7ab7c-c79d-4b84-b913-b2ec3f8e8a98
Splunk	The following analytic detects compiler usage with flags commonly used to create shared libraries that auto-run initialization functions, which are often associated with local privilege escalation exploits.	Generic	stable	process_creation	linux	Sysmon	Privilege Escalation Exploitation for Privilege Escalation Stealth Obfuscated Files or Information Compile After Delivery Execution Shared Modules Resource Development Stage Capabilities	CVE-2025-32463	medium	Raven Tait, Splunk	2026-07-08	2026-07-08	9dbf4a61-0493-43bd-932c-532ba7671a7a
	Detects the loading of unsigned .node files. (...)	Generic	experimental	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL Stealth Masquerading Match Legitimate Resource Name or Location Execution Shared Modules	-	medium	Jonathan Beierle (@hullabrian)	2025-11-22	2026-08-27	e5f5c693-52d7-4de5-88ae-afbfbce85595
Splunk	The following analytic identifies instances where executable files (.exe) are loaded as modules, detected through 'ImageLoaded' events in Sysmon logs. (...)	Generic	stable	image_load	windows	Sysmon	Execution Shared Modules	-	medium	Teoderick Contreras, Splunk	2023-09-19	2026-05-13	3e27af56-fcf0-4113-988d-24969b062be7
Splunk	Detects the creation of a DLL within the various PowerShell module directories. (...)	Anomaly	stable	file_event	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell Execution, Stealth Hijack Execution Flow Execution Shared Modules	-	medium	Raven Tait, Splunk	2021-09-02	2026-05-13	ef018634-8999-4854-9344-bde9593468e7
Splunk	Detects specific indicators associated with the execution of the TabExpansion internal function in PowerShell. (...)	Anomaly	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Execution Shared Modules	-	medium	Raven Tait, Splunk	2026-05-05	2026-05-13	d36a09b3-35ac-4d6f-964a-39fd337abc2f
Splunk	The following analytic detects image load events where a process loads a file from a remote share path. (...)	Anomaly	stable	image_load	windows	Sysmon	Execution Command and Scripting Interpreter Execution Exploitation for Client Execution Privilege Escalation Exploitation for Privilege Escalation Execution Shared Modules	-	medium	Raven Tait, Splunk	2026-05-05	2026-05-13	041aaae4-03de-465c-b9cb-9ed0d1e10454
Splunk	Detects the creation of an XLL file outside of typical locations. (...)	Anomaly	stable	file_event	windows	Sysmon	Execution Command and Scripting Interpreter Execution Shared Modules	-	medium	Raven Tait, Splunk	2021-09-02	2026-05-13	7cdbe5e2-878d-4020-94f3-52938760155e

Title

Description

Shared Modules T1129

Shared Modules T1129

Shared Modules MITRE reference T1129

Shared Modules MITRE reference T1129

Offense vs defense T1129

Shared Modules detection strategy DET0018

Behavior-chain, platform-aware detection strategy for T1129 Shared Modules

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Shared Modules detections T1129

Shared Modules detections T1129