Detect LC_LOAD_DYLIB Addition in Google Chronicle
Adversaries may establish persistence by executing malicious content triggered by the loading of a dynamically linked shared library. Mach-O binaries on macOS have a series of load commands that dictate how/when the binary is executed, including a set of libraries to load. The LC_LOAD_DYLIB command in a Mach-O binary tells macOS to load a specific dynamic library (.dylib) when that binary executes. Adversaries can add their own LC_LOAD_DYLIB load command to any Mach-O binary, causing their malicious library to be loaded whenever the modified binary is executed. This provides persistence that is triggered by the execution of legitimate binaries.
MITRE ATT&CK
- Tactic
- Privilege Escalation Persistence
- Technique
- T1546 Event Triggered Execution
- Sub-technique
- T1546.006 LC_LOAD_DYLIB Addition
- Canonical reference
- https://attack.mitre.org/techniques/T1546/006/
YARA-L Detection Query
rule macos_lc_load_dylib_addition {
meta:
author = "Detection Engineering"
description = "Detects use of Mach-O binary manipulation tools with LC_LOAD_DYLIB-related arguments indicating potential dylib injection for persistence (T1546.006)"
mitre_attack_tactic = "Persistence"
mitre_attack_technique = "T1546.006"
severity = "HIGH"
priority = "HIGH"
events:
$e.metadata.event_type = "PROCESS_LAUNCH"
$e.principal.platform = "MAC"
$e.target.process.file.full_path = /install_name_tool|otool|codesign|lipo|jtool|jtool2|macho_tool/ nocase
(
$e.target.process.command_line = /-add_rpath/ nocase or
$e.target.process.command_line = /-change / nocase or
$e.target.process.command_line = /-rpath / nocase or
$e.target.process.command_line = /LC_LOAD_DYLIB/ nocase or
$e.target.process.command_line = /@rpath/ nocase or
$e.target.process.command_line = /@loader_path/ nocase or
$e.target.process.command_line = /@executable_path/ nocase
)
condition:
$e
}Chronicle YARA-L 2.0 rule detecting macOS Mach-O manipulation tool execution with dylib injection arguments. Monitors PROCESS_LAUNCH UDM events on Mac endpoints for install_name_tool, otool, jtool and similar tools invoked with LC_LOAD_DYLIB modification flags associated with T1546.006 persistence.
Data Sources
Required Tables
False Positives & Tuning
- Xcode and developer toolchain build scripts that invoke install_name_tool to set library paths during compilation and linking
- Open source package management tools (Homebrew, conda, MacPorts) that manipulate dylib RPATHs during package installation
- Automated testing frameworks on macOS that use codesign or lipo for binary compatibility testing across architectures
Other platforms for T1546.006
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Inspect Mach-O Binary Load Commands with otool
Expected signal: Process creation event for otool with -l /bin/ls arguments. The output reveals all existing dylib dependencies. This is reconnaissance activity that precedes actual injection.
- Test 2Add RPATH to Binary with install_name_tool
Expected signal: Process creation event for install_name_tool with -add_rpath flag. File modification event for /tmp/argus_test_binary. The combination of install_name_tool + -add_rpath + target binary is the key signal.
- Test 3Create Malicious Dylib in User Library Path
Expected signal: Process creation events for gcc. File creation event for libpayload.dylib in ~/Library/Application Support/.hidden — a hidden directory in a user-writable location. The .dylib file creation in a non-system path is the detection trigger.
References (5)
- https://attack.mitre.org/techniques/T1546/006/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.006/T1546.006.md
- https://www.virusbulletin.com/virusbulletin/2015/03/dylib-hijacking-os-x
- https://objective-see.org/blog.html
- https://developer.apple.com/library/archive/documentation/DeveloperTools/Conceptual/DynamicLibraries/100-Articles/DynamicLibraryDesignGuidelines.html
Unlock Pro Content
Get the full detection package for T1546.006 including response playbook, investigation guide, and atomic red team tests.