Technique.View on attack.mitre.org
Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API).
Adversaries may use this functionality as a way to execute arbitrary payloads on a victim system. For example, adversaries can modularize functionality of their malware into shared objects that perform various functions such as managing C2 network communications or execution of specific actions on objective.
The Linux & macOS module loader can load and execute shared objects from arbitrary local paths. This functionality resides in `dlfcn.h` in functions such as `dlopen` and `dlsym`. Although macOS can execute `.so` files, common practice uses `.dylib` files.
The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in `NTDLL.dll` and is part of the Windows Native API which is called from functions like `LoadLibrary` at run time.
Rules on DetectionCode tagged with T1129.
| Rule | Level | Log source |
|---|---|---|
| Unsigned .node File Loaded | medium | windows / image_load |
| Rule | Type | Risk | Data source |
|---|---|---|---|
| Linux Suspicious GCC Invocation Building Init Shared Object | TTP | NULL | Sysmon for Linux EventID 1 |
| Windows Executable in Loaded Modules | TTP | NULL | Sysmon EventID 7 |
| Windows PowerShell Module File Created | Anomaly | NULL | Sysmon EventID 11 |
| Windows PowerShell Script TabExpansion Direct Call | Anomaly | NULL | Powershell Script Block Logging 4104 |
| Windows Remote Image Load | Anomaly | NULL | Sysmon EventID 7 |
| Windows XLL File Creation Outside of Typical Location | Anomaly | NULL | Sysmon EventID 11 |
None recorded.
| Used by | Procedure example |
|---|---|
| GroupMustang Panda | Mustang Panda has leveraged `LoadLibrary` to load DLLs. |
| Used by | Procedure example |
|---|---|
| MalwareAstaroth | Astaroth uses the LoadLibraryExW() function to load additional modules. |
| MalwareAttor | Attor's dispatcher can execute additional plugins by loading the respective DLLs. |
| MalwareBLINDINGCAN | BLINDINGCAN has loaded and executed DLLs in memory during runtime on a victim machine. |
| MalwareBOOSTWRITE | BOOSTWRITE has used the DWriteCreateFactory() function to load additional modules. |
| MalwareBumblebee | Bumblebee can use `LoadLibrary` to attempt to execute GdiPlus.dll. |
| MalwareDarkWatchman | DarkWatchman can load DLLs. |
| MalwareDtrack | Dtrack contains a function that calls |
| MalwareEbury | Ebury is executed through hooking the keyutils.so file used by legitimate versions of `OpenSSH` and `libcurl`. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
