Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1546.006sub-technique of T1546 Event Triggered Execution

LC_LOAD_DYLIB Addition

macOSnothing on this site yetT1546.006 on attack.mitre.org

Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries. Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded. The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which dynamic libraries (dylibs) to load during execution time.

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

2

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Cloud account compromise

Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.

how MITRE says to see it

Detection Strategy for LC_LOAD_DYLIB Modification in Mach-O Binaries on macOS

  • Detection focuses on unauthorized modification of Mach-O binaries to include LC_LOAD_DYLIB headers pointing to malicious dylibs. Behavior is identified via a chain of file metadata changes, removal of code signatures, and subsequent anomalous dylib loads at runtime.

what reduces it

  • M1038 Execution Prevention. Allow applications via known hashes.
  • M1045 Code Signing. Enforce that all binaries be signed by the correct Apple Developer IDs.
  • M1047 Audit. Binaries can also be baselined for what dynamic libraries they require, and if an app requires a new dynamic library that wasn't included as part of an update, it should be investigated.

the rest of T1546

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.