Shared Modules T1129
Tactic: Execution
Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API).
Events covered
6 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 7 | Image loaded |
| Sysmon | Event ID 11 | FileCreate |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
| Sysmon-for-Linux | Event ID 1 | Process Create |
Authoring guide
These 23 rules share fields, values, and exclusions.
Fields filtered most (31 distinct)
These fields appear most often in rule filters.
Top indicator values (224 distinct)
These values appear most often in rule predicates.
Exclusions (62 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 2 rules
Elastic 13 rules
- Creation of Hidden Shared Object File
- Execution via local SxS Shared Module
- ImageLoad via Windows Update Auto Update Client
- Potential Privilege Escalation via DLL Redirection
- Suspicious Dylib Load from Temporary Directory
- Suspicious Execution from Foomatic-rip or Cupsd Parent
- Suspicious Execution via Microsoft Office Add-Ins
- Suspicious SolarWinds Web Help Desk Java Module Load or Child Process
- UAC Bypass Attempt via Consent DLL Search Order Hijacking
- UAC Bypass Attempt via DCCW DLL Search Order Hijacking
- Unsigned DLL loaded by DNS Service
- Unusual Library Load via Python
- WPS Office Exploitation via DLL Hijack
Splunk 6 rules
- Linux Suspicious GCC Invocation Building Init Shared Object
- Windows Executable in Loaded Modules
- Windows PowerShell Module File Created
- Windows PowerShell Script TabExpansion Direct Call
- Windows Remote Image Load
- Windows XLL File Creation Outside of Typical Location