AN1209
Analytic 1209
Linux
Detection focuses on identifying abuse of LD_PRELOAD and related linker variables. Defender perspective: monitor unexpected setting or modification of LD_PRELOAD in shell initialization scripts or environment exports, file creation of suspicious shared libraries, and correlation of these modifications with anomalous process execution. Key signals include execve events with LD_PRELOAD defined, newly created .so files in user directories, and processes hooking libc functions exhibiting abnormal behavior.
auditd:SYSCALL
execve with LD_PRELOAD or linker-related environment variables set
auditd:PATH
creation of .so files in non-standard directories (e.g., /tmp, /home/*)
linux:osquery
process environment variables containing LD_PRELOAD
[WatchedEnvVars]
Environment variables like LD_PRELOAD, LD_LIBRARY_PATH. Defenders can tune based on development vs. production systems.
[MonitoredDirectories]
Non-standard library paths (e.g., /tmp, user home dirs). May be tuned to reduce false positives from benign development activity.
[CorrelationWindow]
Timeframe to correlate suspicious library creation with process execution that loads it.
AN1210
Analytic 1210
macOS
Detection centers on DYLD_INSERT_LIBRARIES and DYLD_LIBRARY_PATH abuse. Defender perspective: monitor for modification of these environment variables in shell or plist files, file creation of dylibs in user-controlled paths, and correlation of environment variable usage with unexpected module loads by user applications. Suspicious indicators include processes with DYLD_INSERT_LIBRARIES set, execution of applications loading untrusted dylibs, and anomalies in module load history.
macos:unifiedlog
execution of process with DYLD_INSERT_LIBRARIES set
macos:unifiedlog
create/modify dylib in monitored directories
macos:unifiedlog
loading of unexpected dylibs compared to historical baselines
[WatchedEnvVars]
macOS linker variables like DYLD_INSERT_LIBRARIES. Tunable to development environments where use may be expected.
[BaselineDylibs]
Known dylibs typically loaded by apps. Deviations highlight potential hijacking.
[MonitoredDirectories]
Locations where dylibs are monitored for tampering (e.g., /Applications, /System/Library, /tmp).