DYLD_INSERT_LIBRARIES DYLIB injection in macOS / OSX
Tags
cmtmf-attack-pattern: Code Injection
attack-pattern: Data Code Injection - T1540 Code Signing - T1553.002 Dylib Hijacking - T1574.004 Hooking - T1617 Python - T1059.006 Sharepoint - T1213.002 Software - T1592.002 Ssh - T1021.004 Code Signing - T1116 Dylib Hijacking - T1157 Hooking - T1179 Sudo - T1169 Hooking
Show in Graph
Common Information
Type Value
UUID b048f443-7b13-48f3-8ba9-60135e9e240f
Fingerprint af011c1b2e0f141c
Analysis status DONE
Considered CTI value 2
Text language
Published July 9, 2019, midnight
Added to db Sept. 26, 2022, 9:31 a.m.
Last updated Nov. 17, 2024, 11:36 p.m.
Headline DYLD_INSERT_LIBRARIES DYLIB injection in macOS / OSX
Title DYLD_INSERT_LIBRARIES DYLIB injection in macOS / OSX
Detected Hints/Tags/Attributes 49/2/21
Source URLs
Redirection Url
Details Source https://theevilbit.github.io/posts/dyld_insert_libraries_dylib_injection_in_macos_osx_deep_dive/
URL Provider
Details Provider Source level domain
Details github.io theevilbit.github.io
Attributes
Details Type #Events CTI Value
Details Domain 1 
bear.app
Details Domain 18 
opensource.apple.com
Details Domain 1 
helloworldcocoa.app
Details Domain 1 
fitzl.csaba.dev
Details Domain 1175 
gmail.com
Details Domain 33 
com.apple.security
Details Domain 4 
utility.app
Details Domain 359 
com.apple
Details Email 1 
fitzl.csaba.dev@gmail.com
Details Email 1 
fitzl.csaba@gmail.com
Details File 3 
dyld.cpp
Details File 1 
fitzl.cs
Details File 130 
info.pl
Details File 15 
security.cs
Details sha1 1 
348bf4f1a2cf3d6b608e3d4cfd0d673fdd7c9795
Details sha1 1 
2a3de5a788d89ef100d1193c492bfddd6042e04c
Details sha1 1 
2fbbd1e193e5dff4248aadeef196ef181b1adc26
Details sha1 1 
7d06a7229cbc476270e455cb3ef88bdddf109f12
Details IPv4 1441 
127.0.0.1
Details Url 1 
https://opensource.apple.com/source/dyld/dyld-210.2.3/src/dyld.cpp
Details Url 1 
http://127.0.|