type: attack-pattern
spec_version: 2.1
id: attack-pattern--0a5231ec-41af-4a35-83d0-6bdf11f28c65
created: 2017-05-31T21:31:40.542Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1129
external_id: T1129
source_name: RotaJakiro 2021 netlab360 analysis
description:  Alex Turing, Hui Wang. (2021, April 28). RotaJakiro: A long live secret backdoor with 0 VT detection. Retrieved June 14, 2023.
url: https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/
source_name: Apple Dev Dynamic Libraries
description: Apple. (2012, July 23). Overview of Dynamic Libraries. Retrieved September 7, 2023.
url: https://developer.apple.com/library/archive/documentation/DeveloperTools/Conceptual/DynamicLibraries/100-Articles/OverviewOfDynamicLibraries.html
source_name: Unit42 OceanLotus 2017
description: Erye Hernandez and Danny Tsechansky. (2017, June 22). The New and Improved macOS Backdoor from OceanLotus. Retrieved September 8, 2023.
url: https://unit42.paloaltonetworks.com/unit42-new-improved-macos-backdoor-oceanlotus/
source_name: Microsoft DLL
description: Microsoft. (2023, April 28). What is a DLL. Retrieved September 7, 2023.
url: https://learn.microsoft.com/troubleshoot/windows-client/deployment/dynamic-link-library
source_name: Linux Shared Libraries
description: Wheeler, D. (2003, April 11). Shared Libraries. Retrieved September 7, 2023.
url: https://tldp.org/HOWTO/Program-Library-HOWTO/shared-libraries.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:22.302Z
name: Shared Modules
description: Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., [Native API](https://attack.mitre.org/techniques/T1106)).

Adversaries may use this functionality as a way to execute arbitrary payloads on a victim system. For example, adversaries can modularize functionality of their malware into shared objects that perform various functions such as managing C2 network communications or execution of specific actions on objective.

The Linux & macOS module loader can load and execute shared objects from arbitrary local paths. This functionality resides in `dlfcn.h` in functions such as `dlopen` and `dlsym`. Although macOS can execute `.so` files, common practice uses `.dylib` files.(Citation: Apple Dev Dynamic Libraries)(Citation: Linux Shared Libraries)(Citation: RotaJakiro 2021 netlab360 analysis)(Citation: Unit42 OceanLotus 2017)

The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in `NTDLL.dll` and is part of the Windows [Native API](https://attack.mitre.org/techniques/T1106) which is called from functions like `LoadLibrary` at run time.(Citation: Microsoft DLL)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: execution
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Stefan Kanthak
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
macOS
Windows
x_mitre_version: 2.3
x_mitre_remote_support: no