Applied Cybernetics Group
T1574.006 Dynamic Linker Hijacking
- Technique
T1574.006- Tactics
- Defense Evasion, Execution
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 2
- Elastic, Splunk
- 22
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1574/006
MITRE description
Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from various environment variables and files, such as <code>LD_PRELOAD</code> on Linux or <code>DYLD_INSERT_LIBRARIES</code> on macOS.(Citation: TheEvilBit DYLD_INSERT_LIBRARIES)(Citation: Timac DYLD_INSERT_LIBRARIES)(Citation: Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass) Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries)(Citation: Apple Doco Archive Dynamic Libraries) Each platform's linker uses an extensive list of environment variables at different points in execution. These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions in the original library.(Citation: Baeldung LD_PRELOAD) Hijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges. On Linux, adversaries may set <code>LD_PRELOAD</code> to point to malicious libraries that match the name of legitimate libraries which are requested by a victim program, causing the operating system to load the adversary's malicious code upon execution of the victim program. For example, adversaries have used `LD_PRELOAD` to inject a malicious library into every descendant process of the `sshd` daemon, resulting in execution under a legitimate process. When the executing sub-process calls the `execve` function, for example, the malicious library’s `execve` function is executed rather than the system function `execve` contained in the system library on disk. This allows adversaries to [Hide Artifacts](https://attack.mitre.org/techniques/T1564) from detection, as hooking system functions such as `execve` and `readdir` enables malware to scrub its own artifacts from the results of commands such as `ls`, `ldd`, `iptables`, and `dmesg`.(Citation: ESET Ebury Oct 2017)(Citation: Intezer Symbiote 2022)(Citation: Elastic Security Labs Pumakit 2024)
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-28Cisco Talos: Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Detection coverage
SigmaHQ community rules
- Modification of ld.so.preload (core)
- Code Injection by ld.so Preload (core)
Elastic and Splunk rules
- Dynamic Linker Modification Detected via Defend for Containers (elastic)
- Suspicious Echo or Printf Execution Detected via Defend for Containers (elastic)
- Potential Persistence via File Modification (elastic)
- Dynamic Linker Creation (elastic)
- Unusual LD_PRELOAD/LD_LIBRARY_PATH Command Line Arguments (elastic)
- Dynamic Linker (ld.so) Creation (elastic)
- Unusual Preload Environment Variable Process Execution (elastic)
- Suspicious Dynamic Linker Discovery via od (elastic)
- Pod or Container Creation with Suspicious Command-Line (elastic)
- Dynamic Linker Copy (elastic)
- Shared Object Created by Previously Unknown Process (elastic)
- Potential Suspicious File Edit (elastic)
- Potential CVE-2025-32463 Nsswitch File Creation (elastic)
- Modification of Dynamic Linker Preload Shared Object (elastic)
- Potential Privilege Escalation via PKEXEC (elastic)
- Dylib Injection via Process Environment Variables (elastic)
- Modification of Environment Variable via Unsigned or Untrusted Parent (elastic)
- GitHub Workflow File Creation or Modification (splunk)
- Linux Auditd Preload Hijack Library Calls (splunk)
- Linux Auditd Preload Hijack Via Preload File (splunk)
- Linux Preload Hijack Library Calls (splunk)
- Shai-Hulud Workflow File Creation or Modification (splunk)