Shared Modules T1129

Tactic: Execution

Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API).

Events covered

6 catalog events are tagged with this technique by at least one rule.

Authoring guide

These 23 rules share fields, values, and exclusions.

Fields filtered most (32 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
process_name10eq 6, starts_with 3, in 2dllhost.exe, *x86_64-linux-gnu-gcc*, ., bash, busybox
ImageLoaded9starts_with 4, ends_with 2, wildcard 2, contains 1, ne 1*.dll, .node, .vscode\extensions\ms-toolsai.jupyter-, /private/tmp/, /tmp/
host.os.type8eq 8
EventType7eq 4, in 1, starts_with 1, wildcard 1load, rename, start, Image loaded, Image loaded*
Image6starts_with 3, ends_with 1, eq 1, wildcard 1./, /boot/, /dev/shm/, /library/fonts/, /library/graphics/
TargetFilename6wildcard 4, ends_with 1, eq 1*\\windowspowershell\\modules\\*.dll, .xll, ?:\*\consent.exe.*\*.dll, ?:\*\dccw.exe.*\*.dll, ?:\users\*\appdata\local\temp\wps\inetcache\*
event.type5eq 5start, change, creation
parent_process_name4eq 3, in 1cmd.exe, consent.exe, cupsd, dccw.exe, explorer.exe
EventID3eq 37, 4104
event.category3eq 3library, process
CommandLine2contains 1, wildcard 1*/dev/shm/*, */dev/tcp*, */dev/tcp/*, -shared, -wl,-init,
Signed2eq 1, ne 1false, true
dll.code_signature.exists2eq 2false
dll.code_signature.trusted2eq 2false
process.Ext.token.integrity_level_name2eq 2high, system

Top indicator values (213 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
event.typeeq
start
41078
event.categoryeq
library
322
event.categoryeq
process
3142
EventIDeq
7
241
EventTypeeq
load
224
EventTypeeq
rename
222
EventTypeeq
start
2391
Imagestarts_with
/var/tmp/
256
dll.code_signature.existseq
false
222
dll.code_signature.trustedeq
false
221
process_nameeq
dllhost.exe
219
CommandLinecontains
-shared
1
CommandLinecontains
-wl,-init,
1
CommandLinecontains
.so
1
CommandLinewildcard
*/dev/shm/*
19
CommandLinewildcard
*/dev/tcp*
111
CommandLinewildcard
*/dev/tcp/*
15
CommandLinewildcard
*/dev/udp/*
112
CommandLinewildcard
*/etc/init.d*
14
CommandLinewildcard
*/etc/ld.so*
14
CommandLinewildcard
*/etc/passwd*
110
CommandLinewildcard
*/etc/profile*
13
CommandLinewildcard
*/etc/rc.local*
14
CommandLinewildcard
*/etc/shadow*
112
CommandLinewildcard
*/etc/ssh*
110
CommandLinewildcard
*/etc/sudoers*
14
CommandLinewildcard
*/etc/update-motd.d*
14
CommandLinewildcard
*/home/*/.ssh/*
111
CommandLinewildcard
*/root/.ssh*
19
CommandLinewildcard
*/var/tmp*
1

Exclusions (47 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
Imageeq
?:\windows\system32\werfault.exe
2
Imageeq
?:\windows\syswow64\werfault.exe
2
Imageeq
?:\windows\system32\cttune.exe
1
Imageeq
?:\windows\system32\wermgr.exe
1
Imageeq
?:\windows\syswow64\cttune.exe
1
Imageeq
?:\windows\syswow64\wermgr.exe
1
dll.code_signature.trustedeq
true
2
Imageends_with
\code.exe
1
Imagewildcard
./usr/bin/podman
1
Imagewildcard
/home/*/.aimee-code/bin/opencode
1
Imagewildcard
/home/*/.local/share/containers/storage/overlay/*/opencode
1
Imagewildcard
/home/*/.nvm/*/bin/kilo
1
Imagewildcard
/home/*/.opencode/bin/opencode
1
Imagewildcard
/home/*/.vscode-server/*/server/node
1
Imagewildcard
/usr/local/share/npm-global/lib/node_modules/opencode-ai/bin/.opencode
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 2 rules

Elastic 13 rules

Splunk 6 rules

YARA-L 2 rules