Dylib Hijacking on macOS (T1574.004) for Defenders

Dylib Hijacking (T1574.004) is a macOS technique in the stealth and execution tactics. The adversary places a malicious dynamic library, a dylib, with an expected name in a path a victim application searches at runtime.

How attackers use it

The macOS dynamic loader tries search paths in order. Paths may start with @rpath, which lets developers list several search locations relative to the executable. With weak linking, such as the LC_LOAD_WEAK_DYLIB load command, an application still runs even if an expected dylib is missing. Developers use this to support several macOS versions.

An adversary can insert a malicious dylib with the name of a missing one at an identified path. The dylib loads into the application's address space and inherits its privilege level and resources. That can mean privilege escalation and unrestricted network access, and it can evade security products because execution is masked under a legitimate process.

How to detect it

MITRE's analytic describes patterns to watch:

• Unexpected creation or modification of dylib files in application bundle paths
• Unusual module loads compared with the process's history
• Applications loading dylibs from suspicious directories, such as /tmp or user-controlled paths

Correlating file system changes, process execution and module loads gives the highest fidelity.

How to reduce the risk

MITRE lists one mitigation: restrict file and directory permissions. Set access controls to prevent writes to the search paths for applications, both in the folders the applications run from and in the standard dylib folders.

Check your own environment

# macOS: list the libraries an executable links against (replace the path)
otool -L /Applications/Example.app/Contents/MacOS/Example

• Can a standard user write inside application bundles or their search paths?
• Do you log new dylib files appearing under application folders?

Quick check

Sources

• MITRE ATT&CK T1574.004: Dylib Hijacking