Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from various environment variables and files, such as LD_PRELOAD on Linux or DYLD_INSERT_LIBRARIES on macOS.[1][2][3] Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name.[4][5][6] Each platform's linker uses an extensive list of environment variables at different points in execution. These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions in the original library.[7]
Hijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges. On Linux, adversaries may set LD_PRELOAD to point to malicious libraries that match the name of legitimate libraries which are requested by a victim program, causing the operating system to load the adversary's malicious code upon execution of the victim program. For example, adversaries have used LD_PRELOAD to inject a malicious library into every descendant process of the sshd daemon, resulting in execution under a legitimate process. When the executing sub-process calls the execve function, for example, the malicious library’s execve function is executed rather than the system function execve contained in the system library on disk. This allows adversaries to Hide Artifacts from detection, as hooking system functions such as execve and readdir enables malware to scrub its own artifacts from the results of commands such as ls, ldd, iptables, and dmesg.[8][9][10]
Hijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges.
| ID | Name | Description |
|---|---|---|
| G0096 | APT41 | |
| G0143 | Aquatic Panda |
Aquatic Panda modified the |
| S1105 | COATHANGER |
COATHANGER copies the malicious file |
| S0377 | Ebury |
When Ebury is running as an OpenSSH server, it uses LD_PRELOAD to inject its malicious shared module in to programs launched by SSH sessions. Ebury hooks the following functions from |
| S0394 | HiddenWasp |
HiddenWasp adds itself as a shared object to the LD_PRELOAD environment variable.[15] |
| S0601 | Hildegard |
Hildegard has modified /etc/ld.so.preload to intercept shared library import functions.[16] |
| G0106 | Rocke |
Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.[17] |
| S0658 | XCSSET |
XCSSET adds malicious file paths to the |
| ID | Mitigation | Description |
|---|---|---|
| M1038 | Execution Prevention |
Adversaries may use new payloads to execute this technique. Identify and block potentially malicious software executed through hijacking by using application control solutions also capable of blocking libraries loaded by legitimate software. |
| M1028 | Operating System Configuration |
When System Integrity Protection (SIP) is enabled in macOS, the aforementioned environment variables are ignored when executing protected binaries. Third-party applications can also leverage Apple’s Hardened Runtime, ensuring these environment variables are subject to imposed restrictions.[19] Admins can add restrictions to applications by setting the setuid and/or setgid bits, use entitlements, or have a __RESTRICT segment in the Mach-O binary. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0017 | Command | Command Execution |
Monitor executed commands and arguments associated with modifications to variables and files associated with loading shared libraries such as |
| DS0022 | File | File Creation |
Monitor for newly constructed files that are added to absolute paths of shared libraries such as |
| File Modification |
Monitor for changes to files associated with loading shared libraries such as |
||
| DS0011 | Module | Module Load |
Monitor library metadata, such as a hash, and compare libraries that are loaded at process execution time against previous executions to detect differences that do not correlate with patching or updates. |
| DS0009 | Process | Process Creation |
Monitor for newly executed processes for unusual activity (e.g., a process that does not use the network begins to do so). |