Dylib Hijacking
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
T1574.004's only analytic, AN0435, offers exactly three Sigma logsources -- process execution events with dylib load activity, dylib file creation, and dylib file replacement -- and all three map to the identical {product: macos, service: unifiedlog}. No rule anywhere in this corpus has an established Sigma field vocabulary for macos:unifiedlog (scripts/mitre/logsource.mjs passes every macOS family straight through with the bare note 'macOS log', and translate.ts carries no macOS field-name table), so any selection written against it would parse, render in four backends, and match nothing -- the exact silent-failure trap this pipeline exists to avoid. The technique is macOS-only, so there is no Windows or Linux leg to fall back to, and the parent T1574's own decline already names this same blocker against AN0611's macos:unifiedlog sources for the family generally. […]
What the technique is
Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an expected name in a path a victim application searches at runtime. The dynamic loader will try to find the dylibs based on the sequential order of the search paths. Paths to dylibs may be prefixed with @rpath, which allows developers to use relative paths to specify an array of search paths used at runtime based on the location of the executable. Additionally, if weak linking is used, such as the LC_LOAD_WEAK_DYLIB function, an application will still execute even if an expected dylib is not present. Weak linking enables developers to run an application on multiple macOS versions as new APIs are added. Adversaries may gain execution by inserting malicious dylibs with the name of the missing dylib in the identified path. Dylibs are loaded into an application's address space allowing the malicious dylib to inherit the application's privilege level and resources. Based on the application, this could result in privilege escalation and uninhibited network access. This method may also evade detection from security products since the execution is masked under a legitimate process.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0435
Detection focuses on adversaries placing or modifying malicious dylibs in locations searched by legitimate applications. From the defender’s perspective, observable patterns include unexpected creation or modification of dylib files in application bundle paths, unusual module loads by processes compared to historical baselines, and execution of applications loading dylibs from suspicious directories (e.g., /tmp, user-controlled paths). Correlation across file system changes, process execution, and module loads provides high-fidelity detection.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.