Techniques › T1546.006 › AN0607
AN0607 Analytic 0607
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection focuses on unauthorized modification of Mach-O binaries to include LC_LOAD_DYLIB headers pointing to malicious dylibs. Behavior is identified via a chain of file metadata changes, removal of code signatures, and subsequent anomalous dylib loads at runtime. Correlation of file changes with lack of authorized updates and process memory mapping of unrecognized or unsigned libraries is crucial.</p>
- Detects
- T1546.006 LC_LOAD_DYLIB Addition
- Part of
- DET0216 Detection Strategy for LC_LOAD_DYLIB Modification in Mach-O Binaries on macOS
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | Process memory maps new dylib (dylib_load event) | DC0016 Module Load |
| macos:unifiedlog | Mach-O binary modified or LC_LOAD_DYLIB segment inserted | DC0061 File Modification |
| macos:unifiedlog | Code signature validation fails or is absent post-binary modification | DC0059 File Metadata |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Correlates binary modification and dylib load within a defined time interval (e.g., 1 hour) |
DylibPathRegex | Regular expression to match known malicious or uncommon library paths |
UnsignedDylibThreshold | Number of unsigned or unrecognized dylibs mapped into memory per process |
UserContext | Scope monitoring to non-admin users or sensitive system directories |