1200KM / detection
T1129 Shared Modules — Detection Rules
Detection workspace for T1129 Shared Modules: 1 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Unsigned .node File Loaded · experimental · medium · {"category":"image_load","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0018 Behavior-chain, platform-aware detection strategy for T1129 Shared Modules
AN0052 Analytic 0052
A process (often LOLBin or user-launched program) loads a DLL from a user-writable/UNC/Temp path or unsigned/invalid signer. Within a short window the DLL is (a) newly written to disk, (b) spawned as follow-on execution (rundll32/regsvr32), or (c) establishes outbound C2.
AN0053 Analytic 0053
A process loads a shared object (.so) via dlopen/LD_PRELOAD/open from non-standard or temporary locations (e.g., /tmp, /dev/shm), especially shortly after that .so is written or fetched, or linked via manipulated environment variables (LD_PRELOAD/LD_LIBRARY_PATH).
AN0054 Analytic 0054
A process loads a non-system .dylib/.so via dyld (dlopen/dlsym) from user-writable locations (~/Library, /tmp) or after the library was recently created/downloaded, often followed by network egress or persistence.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
- File Access · DC0055
- File Creation · DC0039
- Module Load · DC0016
- Network Connection Creation · DC0082
- Network Traffic Content · DC0085
- Process Creation · DC0032
- Process Metadata · DC0034
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.