MITRE ATT&CKtechnique

T1129 Shared Modules

Published 2017-05-31 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Execution
Platforms
Linux, macOS, Windows
Version
2.3
Created
2017-05-31

Description

Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API). Adversaries may use this functionality as a way to execute arbitrary payloads on a victim system. For example, adversaries can modularize functionality of their malware into shared objects that perform various functions such as managing C2 network communications or execution of specific actions on objective. The Linux & macOS module loader can load and execute shared objects from arbitrary local paths. This functionality resides in `dlfcn.h` in functions such as `dlopen` and `dlsym`. Although macOS can execute `.so` files, common practice uses `.dylib` files. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in `NTDLL.dll` and is part of the Windows Native API which is called from functions like `LoadLibrary` at run time.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1038 Execution Prevention mitigation

Referenced by MITRE ATT&CK · uses (23)

  • S9050 Vidar software (malware)
  • S1185 LightSpy software (malware)
  • S1154 VersaMem software (malware)
  • S1078 RotaJakiro software (malware)
  • S1039 Bumblebee software (malware)
  • S0673 DarkWatchman software (malware)
  • S0661 FoggyWeb software (malware)
  • G0129 Mustang Panda group
  • S0567 Dtrack software (malware)
  • S0607 KillDisk software (malware)
  • S0603 Stuxnet software (malware)
  • S0520 BLINDINGCAN software (malware)
  • S0501 PipeMon software (malware)
  • S0467 TajMahal software (malware)
  • S0455 Metamorfo software (malware)
  • S0438 Attor software (malware)
  • S0415 BOOSTWRITE software (malware)
  • S0377 Ebury software (malware)
  • S0373 Astaroth software (malware)
  • S0352 OSX_OCEANLOTUS.D software (malware)
  • S0196 PUNCHBUGGY software (malware)
  • S0203 Hydraq software (malware)
  • S0032 gh0st RAT software (malware)

Referenced by Compliance · mitigates (7)

  • CIS-2.6 Allowlist Authorized Libraries CIS Safeguard v8.1
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References