Dynamic Linker Hijacking
Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from various environment variables and files, such as <code>LD_PRELOAD</code> on Linux or <code>DYLD_INSERT_LIBRARIES</code> on macOS.(Citation: TheEvilBit DYLD_INSERT_LIBRARIES)(Citation: Timac DYLD_INSERT_LIBRARIES)(Citation: Gabilondo D...
BY SOURCE
PROCEDURES (16)
Auto-extracted: 4 detections for inject
Auto-extracted: 2 detections for container
Auto-extracted: 2 detections for credential
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for general monitoring
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for process creation monitoring
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for service