Dynamic Linker Hijacking
Subtechnique · ATTACK:enterprise:T1574.006
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1574.006",
"title": "Dynamic Linker Hijacking",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1574/006",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--633a100c-b2c9-41bf-9be5-905c1b16c825",
"external_id": "T1574.006",
"domain": "enterprise",
"created": "2020-03-13T20:09:59.569Z",
"modified": "2026-05-12T15:12:00.636Z",
"version": "3.0",
"aliases": [
],
"tactics": [
"stealth",
"execution"
],
"source_references": [
{
"source_name": "Apple Doco Archive Dynamic Libraries",
"url": "https://developer.apple.com/library/archive/documentation/DeveloperTools/Conceptual/DynamicLibraries/100-Articles/OverviewOfDynamicLibraries.html"
},
{
"source_name": "Baeldung LD_PRELOAD",
"url": "https://www.baeldung.com/linux/ld_preload-trick-what-is"
},
{
"source_name": "TheEvilBit DYLD_INSERT_LIBRARIES",
"url": "https://theevilbit.github.io/posts/dyld_insert_libraries_dylib_injection_in_macos_osx_deep_dive/"
},
{
"source_name": "Intezer Symbiote 2022",
"url": "https://intezer.com/blog/research/new-linux-threat-symbiote/"
},
{
"source_name": "Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass",
"url": "https://jon-gabilondo-angulo-7635.medium.com/how-to-inject-code-into-mach-o-apps-part-ii-ddb13ebc8191"
},
{
"source_name": "Man LD.SO",
"url": "https://www.man7.org/linux/man-pages/man8/ld.so.8.html"
},
{
"source_name": "Elastic Security Labs Pumakit 2024",
"url": "https://www.elastic.co/security-labs/declawing-pumakit"
},
{
"source_name": "TLDP Shared Libraries",
"url": "https://www.tldp.org/HOWTO/Program-Library-HOWTO/shared-libraries.html"
},
{
"source_name": "Timac DYLD_INSERT_LIBRARIES",
"url": "https://blog.timac.org/2012/1218-simple-code-injection-using-dyld_insert_libraries/"
},
{
"source_name": "ESET Ebury Oct 2017",
"url": "https://www.welivesecurity.com/2017/10/30/windigo-ebury-update-2/"
}
]
}Explicit source assertions (13)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1574.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--086ec3ab-803e-4531-a451-15fa9f06297c
Apple Developer Doco Hardened RuntimeATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1574.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0fc95a6b-296f-41ab-8663-aea4a80afe0a
ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1574.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--165336dd-529c-4ec0-a7ff-2608a42fa16c
Crowdstrike HuntReport 2022ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1574.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47b95300-a51c-4d91-9bbe-e40956df2081
Anomali Rocke March 2019ATTACK:enterprise:S0601 → uses → ATTACK:enterprise:T1574.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4a607e33-3970-4605-af5e-36be82bd142a
Unit 42 Hildegard MalwareATTACK:enterprise:S0394 → uses → ATTACK:enterprise:T1574.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a4c3eb5-9ea2-4e7d-ae9d-d4f0a45c4803
Intezer HiddenWasp Map 2019ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1574.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7af3fbea-cdb1-42e3-a5f0-8ad2e418baff
trendmicro xcsset xcode project 2020ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1574.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7beb0954-f5b9-4c41-a732-c4ebb961148a
Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1574.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7f9fe6d5-79ba-44ca-bf19-c980e5c2fc11
Crowdstrike GTR2020 Mar 2020ATTACK:enterprise:S1105 → uses → ATTACK:enterprise:T1574.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89871b65-3850-440a-8a6b-4ed78a24b13d
NCSC-NL COATHANGER Feb 2024ATTACK:enterprise:S1220 → uses → ATTACK:enterprise:T1574.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf655369-b813-41d7-8108-769d8f5088f1
Google Cloud Mandiant UNC3886 2024ATTACK:enterprise:T1574.006 → subtechnique-of → ATTACK:enterprise:T1574
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c5589abe-78a2-4d41-8926-33aa3fc3337b
ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1574.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d3102278-dab8-485c-9cd2-52f80c4da8bd
ESET Ebury May 2024 · ESET Ebury Oct 2017