1200KM / detection
T1546.006 LC_LOAD_DYLIB Addition — Detection Rules
Detection workspace for T1546.006 LC_LOAD_DYLIB Addition: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0216 Detection Strategy for LC_LOAD_DYLIB Modification in Mach-O Binaries on macOS
AN0607 Analytic 0607
Detection focuses on unauthorized modification of Mach-O binaries to include LC_LOAD_DYLIB headers pointing to malicious dylibs. Behavior is identified via a chain of file metadata changes, removal of code signatures, and subsequent anomalous dylib loads at runtime. Correlation of file changes with lack of authorized updates and process memory mapping of unrecognized or unsigned libraries is crucial.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1546.006 simulation workspace
No reviewed association in this snapshot.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.