T1574.006sub-technique of T1574 Hijack Execution Flow

Dynamic Linker Hijacking

Linux · macOS1 piece on this siteT1574.006 on attack.mitre.org

Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from various environment variables and files, such as `LD_PRELOAD` on Linux or `DYLD_INSERT_LIBRARIES` on macOS.
MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Suspicious execution on an endpoint

An EDR alert, an unexplained process, or a user reporting something odd.

Read

Analyses, case studies, guides, references and interview questions.

ToolCONSTRUCTED

linux-triage.sh: a read-only first-hour collection script for Linux

One Bash file that collects processes, sockets, deleted-but-running binaries, logons, SSH keys, persistence and recent changes in order of volatility, using only what ships with a distribution. It writes text files and a SHA-256 manifest, and it is short enough to read before you run it.

T1574.006

how MITRE says to see it

Detection Strategy for Hijack Execution Flow: Dynamic Linker Hijacking

Detection focuses on identifying abuse of LD_PRELOAD and related linker variables. Defender perspective: monitor unexpected setting or modification of LD_PRELOAD in shell initialization scripts or environment exports, file creation of suspicious shared libraries, and correlation of these modifications with anomalous...
Detection centers on DYLD_INSERT_LIBRARIES and DYLD_LIBRARY_PATH abuse. Defender perspective: monitor for modification of these environment variables in shell or plist files, file creation of dylibs in user-controlled paths, and correlation of environment variable usage with unexpected module loads by user...

what reduces it

M1028 Operating System Configuration. When System Integrity Protection (SIP) is enabled in macOS, the aforementioned environment variables are ignored when executing protected binaries. Third-party applications can also leverage Apple’s Hardened Runtime, ensuring these environment variables are subject to imposed restrictions.
M1038 Execution Prevention. Adversaries may use new payloads to execute this technique. Identify and block potentially malicious software executed through hijacking by using application control solutions also capable of blocking libraries loaded by legitimate software.

the rest of T1574

T1574.001 DLL · 1 on this site
T1574.004 Dylib Hijacking · not covered yet
T1574.005 Executable Installer File Permissions Weakness · not covered yet
T1574.007 Path Interception by PATH Environment Variable · not covered yet
T1574.008 Path Interception by Search Order Hijacking · not covered yet
T1574.009 Path Interception by Unquoted Path · not covered yet
T1574.010 Services File Permissions Weakness · not covered yet
T1574.011 Services Registry Permissions Weakness · not covered yet
T1574.012 COR_PROFILER · not covered yet
T1574.013 KernelCallbackTable · not covered yet
T1574.014 AppDomainManager · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.