Shared Modules

Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API).

Adversaries may use this functionality as a way to execute arbitrary payloads on a victim system. For example, adversaries can modularize functionality of their malware into shared objects that perform various functions such as managing C2 network communications or execution of specific actions on objective.

The Linux & macOS module loader can load and execute shared objects from arbitrary local paths. This functionality resides in dlfcn.h in functions such as dlopen and dlsym. Although macOS can execute .so files, common practice uses .dylib files.[1][2][3][4]

The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like LoadLibrary at run time.[5]

ID: T1129
Sub-techniques:  No sub-techniques
Tactic: Execution
Platforms: Linux, Windows, macOS
Contributors: Stefan Kanthak
Version: 2.2
Created: 31 May 2017
Last Modified: 12 October 2023

Procedure Examples

ID Name Description
S0373 Astaroth

Astaroth uses the LoadLibraryExW() function to load additional modules. [6]

S0438 Attor

Attor's dispatcher can execute additional plugins by loading the respective DLLs.[7]


BLINDINGCAN has loaded and executed DLLs in memory during runtime on a victim machine.[8]


BOOSTWRITE has used the DWriteCreateFactory() function to load additional modules.[9]

S1039 Bumblebee

Bumblebee can use LoadLibrary to attempt to execute GdiPlus.dll.[10]

S0673 DarkWatchman

DarkWatchman can load DLLs.[11]

S0567 Dtrack

Dtrack contains a function that calls LoadLibrary and GetProcAddress.[12]

S0661 FoggyWeb

FoggyWeb's loader can call the load() function to load the FoggyWeb dll into an Application Domain on a compromised AD FS server.[13]

S0032 gh0st RAT

gh0st RAT can load DLLs into memory.[14]

S0203 Hydraq

Hydraq creates a backdoor through which remote attackers can load and call DLL functions.[15][16]

S0607 KillDisk

KillDisk loads and executes functions from a DLL.[17]

S0455 Metamorfo

Metamorfo had used AutoIt to load and execute the DLL payload.[18]


For network communications, OSX_OCEANLOTUS.D loads a dynamic library (.dylib file) using dlopen() and obtains a function pointer to execute within that shared library using dlsym().[4]

S0501 PipeMon

PipeMon has used call to LoadLibrary to load its installer. PipeMon loads its modules using reflective loading or custom shellcode.[19]


PUNCHBUGGY can load a DLL using the LoadLibrary API.[20]

S1078 RotaJakiro

RotaJakiro uses dynamically linked shared libraries (.so files) to execute additional functionality using dlopen() and dlsym().[3]

S0603 Stuxnet

Stuxnet calls LoadLibrary then executes exports from a DLL.[21]

S0467 TajMahal

TajMahal has the ability to inject the LoadLibrary call template DLL into running processes.[22]


ID Mitigation Description
M1038 Execution Prevention

Identify and block potentially malicious software executed through this technique by using application control tools capable of preventing unknown modules from being loaded.


ID Data Source Data Component Detects
DS0011 Module Module Load

Monitoring module loads may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances, since benign use of shared modules load functions are common and may be difficult to distinguish from malicious behavior. Legitimate software will likely only need to load routine, bundled, or system modules such that deviation from known module loads may be suspicious

Limiting module loads to trusted directories, such as %SystemRoot% and %ProgramFiles% on Windows, may protect against module loads from unsafe paths.

DS0009 Process OS API Execution

Monitor for API calls that may execute malicious payloads via loading shared modules.