{"id":"T1129","name":"Shared Modules","url":"https://attack.mitre.org/techniques/T1129","tactics":["execution"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0018","stix_id":"x-mitre-detection-strategy--928a6ce6-fca0-4d66-aba3-1121431b953e","name":"Behavior-chain, platform-aware detection strategy for T1129 Shared Modules","url":"https://attack.mitre.org/detectionstrategies/DET0018","analytics":[{"id":"AN0052","stix_id":"x-mitre-analytic--cc5f309c-6eb0-4f96-ba1a-0f4fd3bc1b79","name":"Analytic 0052","description":"A process (often LOLBin or user-launched program) loads a DLL from a user-writable/UNC/Temp path or unsigned/invalid signer. Within a short window the DLL is (a) newly written to disk, (b) spawned as follow-on execution (rundll32/regsvr32), or (c) establishes outbound C2.","url":"https://attack.mitre.org/detectionstrategies/DET0018#AN0052","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Microsoft-Windows-CodeIntegrity/Operational","channel":"CodeIntegrity/WDAC events indicating unsigned/invalid DLL loads","data_component":"DC0034","data_component_name":"Process Metadata","log_source_slug":"wineventlog-microsoft-windows-codeintegrity-operational"}],"mutable_elements":[{"field":"TimeWindow","description":"Correlation window between file write → module load → network (e.g., 0–20 minutes)."},{"field":"SuspiciousPathRegex","description":"Regex for user-writable/UNC/temp paths to flag (e.g., %TEMP%, %APPDATA%, \\\\*\\share\\)."},{"field":"UnsignedOnly","description":"Alert only when SignatureStatus != Valid to reduce noise."},{"field":"RareSignerThreshold","description":"Frequency threshold for unseen/rare signers in last N days."},{"field":"MinFileSizeKB","description":"Ignore tiny DLL stubs to cut noise."}],"live":true,"detection_strategies":["DET0018"],"techniques":["T1129"]},{"id":"AN0053","stix_id":"x-mitre-analytic--01c969ef-7057-44bd-bced-9b64a98234ec","name":"Analytic 0053","description":"A process loads a shared object (.so) via dlopen/LD_PRELOAD/open from non-standard or temporary locations (e.g., /tmp, /dev/shm), especially shortly after that .so is written or fetched, or linked via manipulated environment variables (LD_PRELOAD/LD_LIBRARY_PATH).","url":"https://attack.mitre.org/detectionstrategies/DET0018#AN0053","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"openat/read/mmap: Open/mmap .so files from non-standard paths","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"auditd-syscall"},{"name":"auditd:EXECVE","channel":"execve: Processes launched with LD_PRELOAD/LD_LIBRARY_PATH pointing to non-system dirs","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-execve"},{"name":"linux:syslog","channel":"sudo or service accounts invoking loaders with suspicious env vars","data_component":"DC0034","data_component_name":"Process Metadata","log_source_slug":"linux-syslog"},{"name":"NSM:Flow","channel":"http/file-xfer: Inbound/outbound transfer of ELF shared objects","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"SuspiciousDirs","description":"(/tmp, /dev/shm, /var/tmp, user home dirs) – adjust to your environment."},{"field":"TimeWindow","description":"Correlate write/fetch of .so to its load (e.g., 0–30 minutes)."},{"field":"EnvVarWatchlist","description":"LD_PRELOAD, LD_LIBRARY_PATH, LD_AUDIT."},{"field":"AllowedSigning/HashList","description":"Known-good signed or hashed shared objects."}],"live":true,"detection_strategies":["DET0018"],"techniques":["T1129"]},{"id":"AN0054","stix_id":"x-mitre-analytic--52a5dffb-f3a3-45fc-97b3-2c09fed8e0b4","name":"Analytic 0054","description":"A process loads a non-system .dylib/.so via dyld (dlopen/dlsym) from user-writable locations (~/Library, /tmp) or after the library was recently created/downloaded, often followed by network egress or persistence.","url":"https://attack.mitre.org/detectionstrategies/DET0018#AN0054","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"dyld/unified log entries indicating image load from non-system paths","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"macos-unifiedlog"},{"name":"macos:endpointsecurity","channel":"exec: Process execution context for loaders calling dlopen/dlsym","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-endpointsecurity"},{"name":"macos:endpointsecurity","channel":"ES_EVENT_TYPE_NOTIFY_OPEN: Open of .dylib/.so in user-writable locations","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"macos-endpointsecurity"}],"mutable_elements":[{"field":"SuspiciousDirs","description":"~/Library, /tmp, /Users/*/.* (hidden dirs) – tune to enterprise layout."},{"field":"UnsignedOnly","description":"Alert only when code-signing is invalid or absent."},{"field":"TimeWindow","description":"Correlate write/open to module load within N minutes."}],"live":true,"detection_strategies":["DET0018"],"techniques":["T1129"]}],"live":true,"version":"1.0","techniques":["T1129"]}],"sigma_rules":[{"id":"e5f5c693-52d7-4de5-88ae-afbfbce85595","title":"Unsigned .node File Loaded","author":"Jonathan Beierle (@hullabrian)","status":"experimental","level":"medium","date":"2025-11-22","modified":null,"description":"Detects the loading of unsigned .node files.\nAdversaries may abuse a lack of .node integrity checking to execute arbitrary code inside of trusted applications such as Slack.\n.node files are native add-ons for Electron-based applications, which are commonly used for desktop applications like Slack, Discord, and Visual Studio Code.\nThis technique has been observed in the DripLoader malware, which uses unsigned .node files to load malicious native code into Electron applications.\n","references":["https://www.coreycburton.com/blog/driploader-case-study","https://github.com/CoreyCBurton/DripLoaderNG","https://www.electronjs.org/docs/latest/tutorial/native-code-and-electron"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.execution","attack.privilege-escalation","attack.persistence","attack.stealth","attack.t1129","attack.t1574.001","attack.t1036.005"],"path":"rules/windows/image_load/image_load_dll_unsigned_node_load.yml","techniques":["T1129","T1574.001","T1036.005"],"cves":[]},{"id":"e6c7ab7c-c79d-4b84-b913-b2ec3f8e8a98","title":"Katz Stealer DLL Loaded","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-05-22","modified":null,"description":"Detects loading of DLLs associated with Katz Stealer malware 2025 variants.\nKatz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems.\nThe process that loads these DLLs are very likely to be malicious.\n","references":["Internal Research"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.execution","attack.t1129","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Malware/Katz-Stealer/image_load_win_katz_stealer_payloads.yml","techniques":["T1129"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}