Common Information
| Type | Value |
|---|---|
| Value |
Dynamic Linker Hijacking - T1574.006 |
| Category | Attack-Pattern |
| Type | Mitre-Attack-Pattern |
| Misp Type | Cluster |
| Description | Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from environment variables and files, such as <code>LD_PRELOAD</code> on Linux or <code>DYLD_INSERT_LIBRARIES</code> on macOS. Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries)(Citation: Apple Doco Archive Dynamic Libraries) These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions without changing the original library.(Citation: Baeldung LD_PRELOAD) On Linux and macOS, hijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges. This method may also evade detection from security products since the execution is masked under a legitimate process. Adversaries can set environment variables via the command line using the <code>export</code> command, <code>setenv</code> function, or <code>putenv</code> function. Adversaries can also leverage [Dynamic Linker Hijacking](https://attack.mitre.org/techniques/T1574/006) to export variables in a shell or set variables programmatically using higher level syntax such Python’s <code>os.environ</code>. On Linux, adversaries may set <code>LD_PRELOAD</code> to point to malicious libraries that match the name of legitimate libraries which are requested by a victim program, causing the operating system to load the adversary's malicious code upon execution of the victim program. <code>LD_PRELOAD</code> can be set via the environment variable or <code>/etc/ld.so.preload</code> file.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries) Libraries specified by <code>LD_PRELOAD</code> are loaded and mapped into memory by <code>dlopen()</code> and <code>mmap()</code> respectively.(Citation: Code Injection on Linux and macOS)(Citation: Uninformed Needle) (Citation: Phrack halfdead 1997)(Citation: Brown Exploiting Linkers) On macOS this behavior is conceptually the same as on Linux, differing only in how the macOS dynamic libraries (dyld) is implemented at a lower level. Adversaries can set the <code>DYLD_INSERT_LIBRARIES</code> environment variable to point to malicious libraries containing names of legitimate libraries or functions requested by a victim program.(Citation: TheEvilBit DYLD_INSERT_LIBRARIES)(Citation: Timac DYLD_INSERT_LIBRARIES)(Citation: Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass) |
| Details | Published | Attributes | CTI | Title | ||
|---|---|---|---|---|---|---|
| Details | Website | 2025-02-03 | 3 | Cyber Kill Chain : A Step By Step Guide To Complete The Tasks of The Room In 2025 (Tryhackme). | ||
| Details | Website | 2025-02-02 | 5 | Cyber Kill Chain | TryHackMe — Walkthrough | ||
| Details | Website | 2025-01-27 | 26 | Linux Detection Engineering - A Continuation on Persistence Mechanisms — Elastic Security Labs | ||
| Details | Website | 2025-01-20 | 4 | Pumakit - Sophisticated Linux Rootkit That Persist Even After Reboots | ||
| Details | Website | 2025-01-16 | 13 | Pumakit: A Sophisticated Linux Rootkit Targeting Critical Infrastructure - SOCRadar® Cyber Intelligence Inc. | ||
| Details | Website | 2024-11-27 | 13 | Bootkitty: Analyzing the first UEFI bootkit for Linux | ||
| Details | Website | 2024-11-26 | 51 | Wolfsbane Malware Threat Intel | ||
| Details | Website | 2024-11-21 | 25 | Unveiling WolfsBane: Gelsemium’s Linux counterpart to Gelsevirine | ||
| Details | Website | 2024-10-30 | 28 | Attacker Abuses Victim Resources to Reap Rewards from Titan Network | ||
| Details | Website | 2024-09-30 | 11 | AhnLab EDR을 활용한 리눅스 지속성 유지 기법 탐지 (1) - ASEC | ||
| Details | Website | 2024-09-29 | 11 | Linux Persistence Techniques Detected by AhnLab EDR (1) - ASEC | ||
| Details | Website | 2024-09-23 | 78 | Threat Actors leverage Docker Swarm and Kubernetes to mine cryptocurrency at scale | Datadog Security Labs | ||
| Details | Website | 2024-09-12 | 13 | Emulating the Persistent and Stealthy Ebury Linux Malware | ||
| Details | Website | 2024-09-12 | 41 | From Automation to Exploitation: The Growing Misuse of Selenium Grid for Cryptomining and Proxyjacking | ||
| Details | Website | 2024-06-18 | 30 | Cloaked and Covert: Uncovering UNC3886 Espionage Operations | Google Cloud Blog | ||
| Details | Website | 2024-06-13 | 50 | Attackers deploying new tactics in campaign targeting exposed Docker APIs | Datadog Security Labs | ||
| Details | Website | 2024-03-06 | 59 | Тень пентестера: эксперты F.A.C.C.T. исследовали неизвестные атаки вымогателей Shadow | ||
| Details | Website | 2024-02-01 | 51 | An analysis of a TeamTNT doppelgänger | Datadog Security Labs | ||
| Details | Website | 2023-09-06 | 64 | Summer '23 Cryptomining Attacks: Analysis + Recommendations | Wiz Blog | ||
| Details | Website | 2023-07-19 | 1 | Kubernetes API limitations in finding non-standard pods and containers | Wiz Blog | ||
| Details | Website | 2023-07-17 | 0 | How to get rid of AWS access keys – Part 3: Replacing the authentication | Wiz Blog | ||
| Details | Website | 2023-07-17 | 0 | How to get rid of AWS access keys – Part 3: Replacing the authentication | Wiz Blog | ||
| Details | Website | 2023-07-11 | 8 | PyLoose: Python-based fileless malware targets cloud workloads to deliver cryptominer | Wiz Blog | ||
| Details | Website | 2023-07-05 | 3 | Linux rootkits explained – Part 1: Dynamic linker hijacking | Wiz Blog | ||
| Details | Website | 2023-06-07 | 66 | MISSION2025 Recent Trends Report 31-05-2021 - CYFIRMA |