{"id":"T1546.006","name":"LC_LOAD_DYLIB Addition","url":"https://attack.mitre.org/techniques/T1546/006","tactics":["privilege-escalation","persistence"],"platforms":["macOS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0216","stix_id":"x-mitre-detection-strategy--4f95fef5-3b5e-435a-ad00-33d2d9765640","name":"Detection Strategy for LC_LOAD_DYLIB Modification in Mach-O Binaries on macOS","url":"https://attack.mitre.org/detectionstrategies/DET0216","analytics":[{"id":"AN0607","stix_id":"x-mitre-analytic--7aaf568b-bc31-4fb0-8543-12ee281a0b85","name":"Analytic 0607","description":"Detection focuses on unauthorized modification of Mach-O binaries to include LC_LOAD_DYLIB headers pointing to malicious dylibs. Behavior is identified via a chain of file metadata changes, removal of code signatures, and subsequent anomalous dylib loads at runtime. Correlation of file changes with lack of authorized updates and process memory mapping of unrecognized or unsigned libraries is crucial.","url":"https://attack.mitre.org/detectionstrategies/DET0216#AN0607","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Process memory maps new dylib (dylib_load event)","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Mach-O binary modified or LC_LOAD_DYLIB segment inserted","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Code signature validation fails or is absent post-binary modification","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"TimeWindow","description":"Correlates binary modification and dylib load within a defined time interval (e.g., 1 hour)"},{"field":"DylibPathRegex","description":"Regular expression to match known malicious or uncommon library paths"},{"field":"UnsignedDylibThreshold","description":"Number of unsigned or unrecognized dylibs mapped into memory per process"},{"field":"UserContext","description":"Scope monitoring to non-admin users or sensitive system directories"}],"live":true,"detection_strategies":["DET0216"],"techniques":["T1546.006"]}],"live":true,"version":"1.0","techniques":["T1546.006"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}