Shared Modules
Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., [Native API](https://attack.mitre.org/techniques/T1106)). Adversaries may use this functionality as a way to execute arbitrary payloads on a victim system. For example, adversaries can modularize functionality of their malware into shared objects that per...
BY SOURCE
PROCEDURES (13)
Auto-extracted: 2 detections for general monitoring
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for office
Auto-extracted: 1 detections for office
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for module load monitoring
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for office
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for process creation monitoring