tfMITRE ATT&CK sub-technique

LC_LOAD_DYLIB Addition T1546.006

sub-technique of T1546 Event Triggered Execution

Tactics: Persistence, Privilege Escalation
Platform: macOS
Version: 1.1
Created: 24 January 2020
Last modified: 24 October 2025

Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries. Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded. The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which dynamic libraries (dylibs) to load during execution time. These can be added ad-hoc to the compiled binary as long as adjustments are made to the rest of the fields and dependencies.[1] There are tools available to perform these changes.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1546.006

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

LC_LOAD_DYLIB Addition detection strategy DET0216

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for LC_LOAD_DYLIB Modification in Mach-O Binaries on macOS

Enterprise

1 platform

AN0607 · macOS

Detection focuses on unauthorized modification of Mach-O binaries to include LC_LOAD_DYLIB headers pointing to malicious dylibs. Behavior is identified via a chain of file metadata changes, removal of code signatures, and subsequent anomalous dylib loads at runtime. Correlation of file changes with lack of authorized updates and process memory mapping of unrecognized or unsigned libraries is crucial.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	macos:unifiedlog	Process memory maps new dylib (dylib_load event)
File MetadataDC0059	macos:unifiedlog	Code signature validation fails or is absent post-binary modification
File ModificationDC0061	macos:unifiedlog	Mach-O binary modified or LC_LOAD_DYLIB segment inserted

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Correlates binary modification and dylib load within a defined time interval (e.g., 1 hour)
DylibPathRegex	Regular expression to match known malicious or uncommon library paths
UnsignedDylibThreshold	Number of unsigned or unrecognized dylibs mapped into memory per process
UserContext	Scope monitoring to non-admin users or sensitive system directories

LC_LOAD_DYLIB Addition detections T1546.006

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs