Dynamic Linker Hijacking (T1574.006): LD_PRELOAD and DYLD

Dynamic Linker Hijacking (T1574.006) is a Linux and macOS technique in the stealth and execution tactics. The adversary hijacks the environment variables the dynamic linker uses to load shared libraries.

How attackers use it

Before a program runs, the dynamic linker loads libraries named in certain environment variables and files, such as LD_PRELOAD on Linux or DYLD_INSERT_LIBRARIES on macOS. Libraries named there load first and take precedence over system libraries with the same function names. Developers use these variables to debug without recompiling or to replace functions.

That power is the problem. Hijacking these variables can give access to the victim process's memory and network resources, and possibly elevated privileges. MITRE gives an example: adversaries have used LD_PRELOAD to inject a malicious library into every descendant process of the sshd daemon, so code runs under a legitimate process. When a child calls execve, the malicious library's version runs instead of the system one. Hooking functions like execve and readdir lets malware hide artifacts from detection (T1564).

How to detect it

Linux signals from MITRE's analytic:

• Unexpected setting or change of LD_PRELOAD in shell initialization scripts or environment exports
• New suspicious shared libraries (.so files) in user directories
• execve events with LD_PRELOAD defined
• Processes that hook libc functions and behave abnormally

macOS signals:

• DYLD_INSERT_LIBRARIES or DYLD_LIBRARY_PATH changed in shell or plist files
• New dylibs in user-controlled paths
• Processes with DYLD_INSERT_LIBRARIES set, or applications loading untrusted dylibs

How to reduce the risk

1. Operating system configuration. On macOS, when System Integrity Protection (SIP) is enabled, these variables are ignored for protected binaries. Third-party applications can use Apple's Hardened Runtime so the variables are restricted.
2. Execution prevention. Use application control that can block libraries loaded by legitimate software.

Check your own environment

# Linux: global preload file, and shell startup files that mention LD_PRELOAD
cat /etc/ld.so.preload
grep -n LD_PRELOAD ~/.bashrc ~/.profile /etc/profile /etc/environment

# Linux or macOS: is the variable set in the current environment?
env | grep -E 'LD_PRELOAD|DYLD_'

# macOS: System Integrity Protection status
csrutil status

• Is /etc/ld.so.preload absent or empty on servers where you did not put something there?
• Do you alert on writes to shell startup files and /etc/ld.so.preload?
• Is SIP on for managed Macs?

Quick check

Sources

• MITRE ATT&CK T1574.006: Dynamic Linker Hijacking