Unusual modifications to service binary paths, registry keys, or DLL load paths resulting in alternate execution flow. Defender observes registry key modifications, suspicious file writes into system directories, and processes loading libraries from abnormal paths.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 |
| Module Load (DC0016) | WinEventLog:Sysmon | EventCode=7 |
| Windows Registry Key Modification (DC0063) | WinEventLog:Security | EventCode=4657 |
| File Creation (DC0039) | WinEventLog:Sysmon | EventCode=11 |
| Field | Description |
|---|---|
| ServiceBaseline | Expected registry keys and service paths for comparison. |
| AllowedDllPaths | Directories considered valid for DLL loading. |
| TimeWindow | Correlation interval between registry/file modification and process execution. |
Adversary manipulation of shared library paths, environment variables, or replacement of service binaries. Defender observes suspicious modifications in /etc/ld.so.preload, service config changes, or file writes replacing existing executables.
| Data Component | Name | Channel |
|---|---|---|
| File Modification (DC0061) | auditd:SYSCALL | open/write syscalls targeting /etc/ld.so.preload or binaries in /usr/bin |
| Service Metadata (DC0041) | linux:syslog | Service restart with modified executable path |
| Process Creation (DC0032) | linux:osquery | Process execution with LD_PRELOAD or modified library path |
| Field | Description |
|---|---|
| MonitoredDirectories | Directories where binary replacement should trigger alerts. |
| EnvVarMonitors | Environment variables like LD_PRELOAD or PATH to monitor. |
Abuse of DYLD_INSERT_LIBRARIES or hijacking framework paths for malicious libraries. Defender observes processes invoking abnormal dylibs, modified plist files, or persistence entries pointing to altered binaries.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | macos:unifiedlog | Execution of process with DYLD_INSERT_LIBRARIES set |
| File Modification (DC0061) | macos:unifiedlog | Modified application plist or binary replacement in /Applications |
| Module Load (DC0016) | macos:unifiedlog | Dylib loaded from abnormal location |
| Field | Description |
|---|---|
| AllowedDylibPaths | Baseline directories for dylib loading. |
| PlistMonitors | Specific plist files used for persistence monitoring. |