DET0152 Detection Strategy for Hijack Execution Flow: Dylib Hijacking

Technique Detected: T1574.004 (Dylib Hijacking)

Analytics

macOS

AN0435

Detection focuses on adversaries placing or modifying malicious dylibs in locations searched by legitimate applications. From the defender’s perspective, observable patterns include unexpected creation or modification of dylib files in application bundle paths, unusual module loads by processes compared to historical baselines, and execution of applications loading dylibs from suspicious directories (e.g., /tmp, user-controlled paths). Correlation across file system changes, process execution, and module loads provides high-fidelity detection.

Log Sources

Mutable Elements