Module Load

When a process or program dynamically attaches a shared library, module, or plugin into its memory space. This action is typically performed to extend the functionality of an application, access shared system resources, or interact with kernel-mode components.

Data Collection Measures:

• Event Logging (Windows):
  • Sysmon Event ID 7: Logs when a DLL is loaded into a process.
  • Windows Security Event ID 4688: Captures process creation events, often useful for correlating module loads.
  • Windows Defender ATP: Can provide visibility into suspicious module loads.
• Event Logging (Linux/macOS):
  • AuditD (execve and open syscalls): Captures when shared libraries (.so files) are loaded.
  • Ltrace/Strace: Monitors process behavior, including library calls (dlopen, execve).
  • MacOS Endpoint Security Framework (ESF): Monitors library loads (ES_EVENT_TYPE_NOTIFY_DYLD_INSERT_LIBRARIES).
• Endpoint Detection & Response (EDR):
  • Provide real-time telemetry on module loads and process injections.
  • Sysinternals Process Monitor (procmon): Captures loaded modules and their execution context.
• Memory Forensics:
  • Volatility Framework (malfind, ldrmodules): Detects injected DLLs and anomalous module loads.
  • Rekall Framework: Useful for kernel-mode module detection.
• SIEM and Log Analysis:
  • Centralized log aggregation to correlate suspicious module loads across the environment.
  • Detection rules using correlation searches and behavioral analytics.