tfMITRE ATT&CK sub-technique

Dynamic Linker Hijacking T1574.006

sub-technique of T1574 Hijack Execution Flow

Tactics: Execution, Stealth
Platforms: Linux, macOS
Version: 3.0
Created: 13 March 2020
Last modified: 12 May 2026

Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from various environment variables and files, such as LD_PRELOAD on Linux or DYLD_INSERT_LIBRARIES on macOS.[1][2][3] Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name.[4][5][6] Each platform's linker uses an extensive list of environment variables at different points in execution. These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions in the original library.[7]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware71st pct

Tools & malware71st percentile · 71% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules69th pct

Detection rules69th percentile · 69% of ATT&CK techniques have this many detection rules written or fewer.

Dynamic Linker Hijacking MITRE reference T1574.006

64th pctamong all ATT&CK techniques for number of groups

3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Aquatic PandaG0143 ↗

Modified the ld.so preload file in Linux environments to enable persistence for Winnti malware.1

created 2022-01-181 reference

RockeG0106 ↗

Has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.1

created 2020-05-261 reference

APT41G0096 ↗

Has configured payloads to load via LD_PRELOAD.1

created 2019-09-231 referenceaka Wicked Panda

All 3 groups for this technique

7 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

SPAWNCHIMERAS9024 ↗

Has been compiled as a Position Independent Executable (PIE) to use a third-party library for injection.1

created 2026-04-17MALWARE

MEDUSAS1220 ↗

Can execute code through dynamic linker hijacking of the LD_PRELOAD library.1

created 2025-06-09MALWAREcarried by 1 group

COATHANGERS1105 ↗

Copies the malicious file /data2/.bd.key/preload.so to /lib/preload.so, then launches a child process that executes the malicious file /data2/.bd.key/authd as /bin/authd with the arguments /lib/preload.so reboot newreboot 1.1 This injects the malicious preload.so file into the process with PID 1, and replaces its reboot function with the malicious newreboot function for persistence.

created 2024-02-07MALWARE

XCSSETS0658 ↗

Adds malicious file paths to the DYLD_FRAMEWORK_PATH and DYLD_LIBRARY_PATH environment variables to execute malicious code.1

created 2021-10-05MALWARE

HildegardS0601 ↗

Has modified /etc/ld.so.preload to intercept shared library import functions.1

created 2021-04-07MALWAREcarried by 1 group

HiddenWaspS0394 ↗

Adds itself as a shared object to the LD_PRELOAD environment variable.1

created 2019-06-24MALWARE

All 7 software entries for this technique · 6 newest in this preview

Offense vs defense T1574.006

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 5

first rule: 2019 Q4

Dynamic Linker Hijacking detection strategy DET0435

MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Hijack Execution Flow: Dynamic Linker Hijacking

Enterprise

2 platforms

AN1209 · Linux

Detection focuses on identifying abuse of LD_PRELOAD and related linker variables. Defender perspective: monitor unexpected setting or modification of LD_PRELOAD in shell initialization scripts or environment exports, file creation of suspicious shared libraries, and correlation of these modifications with anomalous process execution. Key signals include execve events with LD_PRELOAD defined, newly created .so files in user directories, and processes hooking libc functions exhibiting abnormal behavior.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve with LD_PRELOAD or linker-related environment variables set
Process MetadataDC0034	linux:osquery	process environment variables containing LD_PRELOAD
File CreationDC0039	auditd:PATH	creation of .so files in non-standard directories (e.g., /tmp, /home/*)

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
WatchedEnvVars	Environment variables like LD_PRELOAD, LD_LIBRARY_PATH. Defenders can tune based on development vs. production systems.
MonitoredDirectories	Non-standard library paths (e.g., /tmp, user home dirs). May be tuned to reduce false positives from benign development activity.
CorrelationWindow	Timeframe to correlate suspicious library creation with process execution that loads it.

AN1210 · macOS

Detection centers on DYLD_INSERT_LIBRARIES and DYLD_LIBRARY_PATH abuse. Defender perspective: monitor for modification of these environment variables in shell or plist files, file creation of dylibs in user-controlled paths, and correlation of environment variable usage with unexpected module loads by user applications. Suspicious indicators include processes with DYLD_INSERT_LIBRARIES set, execution of applications loading untrusted dylibs, and anomalies in module load history.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	macos:unifiedlog	loading of unexpected dylibs compared to historical baselines
Process CreationDC0032	macos:unifiedlog	execution of process with DYLD_INSERT_LIBRARIES set
File ModificationDC0061	macos:unifiedlog	create/modify dylib in monitored directories

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
WatchedEnvVars	macOS linker variables like DYLD_INSERT_LIBRARIES. Tunable to development environments where use may be expected.
BaselineDylibs	Known dylibs typically loaded by apps. Deviations highlight potential hijacking.
MonitoredDirectories	Locations where dylibs are monitored for tampering (e.g., /Applications, /System/Library, /tmp).

Tests3Executorsbash 3Need elevation1 of 3Have prerequisites3Have cleanup2Platformslinux, macos

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Shared Library Injection via /etc/ld.so.preload linux bash Required 1 Yes

This test adds a shared library to the ld.so.preload list to execute and intercept API calls. This technique was used by threat actor Rocke during the exploitation of Linux web servers. This requires the glibc package. Upon successful execution, bash will echo ../bin/T1574.006.so to /etc/ld.so.preload.

Input arguments

Name	Type	Default	Description
path_to_shared_library	path	/tmp/T1574006.so	Path to a shared library object
path_to_shared_library_source	path	PathToAtomicsFolder/T1574.006/src/Linux/T1574.006.c	Path to a shared library source code

Attack command

sudo sh -c 'echo #{path_to_shared_library} > /etc/ld.so.preload'

Cleanup command

sudo sed -i 's##{path_to_shared_library}##' /etc/ld.so.preload

Prerequisite

The shared library must exist on disk at specified location (#{path_to_shared_library})

Check

if [ -f #{path_to_shared_library} ]; then exit 0; else exit 1; fi;

Satisfy

gcc -shared -fPIC -o #{path_to_shared_library} #{path_to_shared_library_source}

GUID0720f3d5-c536-4a43-92cd-8b2424e41ebb

02 Shared Library Injection via LD_PRELOAD linux bash — 1 —

This test injects a shared object library via the LD_PRELOAD environment variable to execute. This technique was used by threat actor Rocke during the exploitation of Linux web servers. This requires the glibc package. Upon successful execution, bash will utilize LD_PRELOAD to load the shared object library /etc/ld.so.preload. Output will be via stdout.

Input arguments

Name	Type	Default	Description
path_to_shared_library	path	/tmp/T1574006.so	Path to a shared library object
path_to_shared_library_source	path	PathToAtomicsFolder/T1574.006/src/Linux/T1574.006.c	Path to a shared library source code

Attack command

LD_PRELOAD=#{path_to_shared_library} ls

Prerequisite

The shared library must exist on disk at specified location (#{path_to_shared_library})

Check

if [ -f #{path_to_shared_library} ]; then exit 0; else exit 1; fi;

Satisfy

gcc -shared -fPIC -o #{path_to_shared_library} #{path_to_shared_library_source}

GUID5d67ed21-a708-4841-9ec3-ba116f109041

03 Dylib Injection via DYLD_INSERT_LIBRARIES macos bash — 1 Yes

injects a dylib that opens calculator via env variable

Input arguments

Name	Type	Default	Description
dylib_file	path	/tmp/T1574006MOS.dylib	Path of dylib file
source_file	path	PathToAtomicsFolder/T1574.006/src/MacOS/T1574.006.c	Path of c source file
file_to_inject	path	/Applications/Firefox.app/Contents/MacOS/firefox	Path of executable to be injected. Mostly works on non-apple default apps.

Attack command

DYLD_INSERT_LIBRARIES=#{dylib_file} #{file_to_inject}

Cleanup command

kill `pgrep Calculator`
kill `pgrep firefox`

Prerequisite

Compile the dylib from (#{source_file}). Destination is #{dylib_file}

Check

gcc -dynamiclib #{source_file} -o #{dylib_file}

Satisfy

gcc -dynamiclib #{source_file} -o #{dylib_file}

GUID363fe590-9268-4ecc-9eef-e918150df08e

Tests from Atomic Red Team (MIT licence) · technique definition

Dynamic Linker Hijacking detections T1574.006

7 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

69th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs