tfMITRE ATT&CK technique

Shared Modules T1129

Tactic: Execution
Platforms: Linux, macOS, Windows
Version: 2.3
Created: 31 May 2017
Last modified: 24 October 2025
Contributor: Stefan Kanthak

Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API).

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 17%

Tools & malware83rd percentile · 83% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules71st pct

Detection rules71st percentile · 71% of ATT&CK techniques have this many detection rules written or fewer.

Shared Modules MITRE reference T1129

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Mustang PandaG0129 ↗

Has leveraged LoadLibrary to load DLLs.1

created 2021-04-121 referenceaka TA416

All 1 groups for this technique

21 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

LightSpyS1185 ↗

LightSpy's main executable and module .dylib binaries are loaded using a combination of dlopen() to load the library, _objc_getClass() to retrieve the class definition, and _objec_msgSend() to invoke/execute the specified method in the loaded class.1

created 2025-01-03MALWAREcarried by 1 group

VersaMemS1154 ↗

Relied on the Java Instrumentation API and Javassist to dynamically modify Java code existing in memory.1

created 2024-08-27MALWAREcarried by 1 group

RotaJakiroS1078 ↗

Uses dynamically linked shared libraries (.so files) to execute additional functionality using dlopen() and dlsym().1

created 2023-06-14MALWAREcarried by 1 group

BumblebeeS1039 ↗

Can use LoadLibrary to attempt to execute GdiPlus.dll.1

created 2022-08-19MALWAREcarried by 2 groups

DarkWatchmanS0673 ↗

Can load DLLs.1

created 2022-01-10MALWARE

FoggyWebS0661 ↗

FoggyWeb's loader can call the load() function to load the FoggyWeb dll into an Application Domain on a compromised AD FS server.1

created 2021-11-16MALWAREcarried by 1 group

All 21 software entries for this technique · 6 newest in this preview

Offense vs defense T1129

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 6

first rule: 2021 Q3

Shared Modules detection strategy DET0018

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavior-chain, platform-aware detection strategy for T1129 Shared Modules

Enterprise

3 platforms

AN0052 · Windows

A process (often LOLBin or user-launched program) loads a DLL from a user-writable/UNC/Temp path or unsigned/invalid signer. Within a short window the DLL is (a) newly written to disk, (b) spawned as follow-on execution (rundll32/regsvr32), or (c) establishes outbound C2.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Process MetadataDC0034	WinEventLog:Microsoft-Windows-CodeIntegrity/Operational	CodeIntegrity/WDAC events indicating unsigned/invalid DLL loads
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Correlation window between file write → module load → network (e.g., 0–20 minutes).
SuspiciousPathRegex	Regex for user-writable/UNC/temp paths to flag (e.g., %TEMP%, %APPDATA%, \\*\share\).
UnsignedOnly	Alert only when SignatureStatus != Valid to reduce noise.
RareSignerThreshold	Frequency threshold for unseen/rare signers in last N days.
MinFileSizeKB	Ignore tiny DLL stubs to cut noise.

AN0053 · Linux

A process loads a shared object (.so) via dlopen/LD_PRELOAD/open from non-standard or temporary locations (e.g., /tmp, /dev/shm), especially shortly after that .so is written or fetched, or linked via manipulated environment variables (LD_PRELOAD/LD_LIBRARY_PATH).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	auditd:SYSCALL	openat/read/mmap: Open/mmap .so files from non-standard paths
Process CreationDC0032	auditd:EXECVE	execve: Processes launched with LD_PRELOAD/LD_LIBRARY_PATH pointing to non-system dirs
Process MetadataDC0034	linux:syslog	sudo or service accounts invoking loaders with suspicious env vars
Network Traffic ContentDC0085	NSM:Flow	http/file-xfer: Inbound/outbound transfer of ELF shared objects

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SuspiciousDirs	(/tmp, /dev/shm, /var/tmp, user home dirs) – adjust to your environment.
TimeWindow	Correlate write/fetch of .so to its load (e.g., 0–30 minutes).
EnvVarWatchlist	LD_PRELOAD, LD_LIBRARY_PATH, LD_AUDIT.
AllowedSigning/HashList	Known-good signed or hashed shared objects.

AN0054 · macOS

A process loads a non-system .dylib/.so via dyld (dlopen/dlsym) from user-writable locations (~/Library, /tmp) or after the library was recently created/downloaded, often followed by network egress or persistence.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	macos:unifiedlog	dyld/unified log entries indicating image load from non-system paths
Process CreationDC0032	macos:endpointsecurity	exec: Process execution context for loaders calling dlopen/dlsym
File AccessDC0055	macos:endpointsecurity	ES_EVENT_TYPE_NOTIFY_OPEN: Open of .dylib/.so in user-writable locations

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SuspiciousDirs	~/Library, /tmp, /Users//. (hidden dirs) – tune to enterprise layout.
UnsignedOnly	Alert only when code-signing is invalid or absent.
TimeWindow	Correlate write/open to module load within N minutes.

Tests1Executorscmd 1Need elevation0 of 1Have prerequisites1Have cleanup1Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

ESXi - Install a custom VIB on an ESXi host

windows

cmd

—

Yes

An adversary can maintain persistence within an ESXi host by installing malicious vSphere Installation Bundles (VIBs). Reference

Input arguments

Name	Type	Default	Description
vm_host	string	atomic.local	Specify the host name of the ESXi Server
vm_pass	string	pass	Specify the privilege user password on ESXi Server
vm_user	string	root	Specify the privilege user account on ESXi Server
vib_file	path	PathToAtomicsFolder\..\atomics\T1129\src\atomicvibes.vib	Path to the dummy vib
pscp_file	path	PathToAtomicsFolder\..\ExternalPayloads\pscp.exe	Path to Pscp
plink_file	path	PathToAtomicsFolder\..\ExternalPayloads\plink.exe	Path to plink
vib_remove	path	PathToAtomicsFolder\..\atomics\T1129\src\esxi_vibremove.txt	Path to script with commands to remove the vib
vib_install	path	PathToAtomicsFolder\..\atomics\T1129\src\esxi_vibinstall.txt	Path to script with commands to install the vib

Attack command

#{pscp_file} -pw #{vm_pass} #{vib_file} #{vm_user}@#{vm_host}:/tmp
echo "" | "#{plink_file}" "#{vm_host}" -ssh  -l "#{vm_user}" -pw "#{vm_pass}" -m "#{vib_install}"

Cleanup command

echo "" | "#{plink_file}" "#{vm_host}" -ssh  -l "#{vm_user}" -pw "#{vm_pass}" -m "#{vib_remove}"

Prerequisite

Check if plink and pscp are available.

Check

if (Test-Path "#{plink_file}") {exit 0} else {exit 1}
if (Test-Path "#{pscp_file}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\plink.exe"
Invoke-WebRequest "https://the.earth.li/~sgtatham/putty/latest/w64/pscp.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\pscp.exe"

GUID4d7f3c50-9ff7-40d2-8b28-e8a14c00b17f

Tests from Atomic Red Team (MIT licence) · technique definition

Shared Modules detections T1129

8 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

71st pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs