cti-ATT-CK-v13.1/enterprise-attack/attack-pattern/attack-pattern--0a5231ec-41af-4a35-83d0-6bdf11f28c65.json

{
    "type": "bundle",
    "id": "bundle--65883957-ede6-411c-b76e-4b47d84ecdcd",
    "spec_version": "2.0",
    "objects": [
        {
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_domains": [
                "enterprise-attack"
            ],
            "x_mitre_contributors": [
                "Stefan Kanthak"
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "type": "attack-pattern",
            "id": "attack-pattern--0a5231ec-41af-4a35-83d0-6bdf11f28c65",
            "created": "2017-05-31T21:31:40.542Z",
            "x_mitre_version": "2.1",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1129",
                    "url": "https://attack.mitre.org/techniques/T1129"
                },
                {
                    "source_name": "Wikipedia Windows Library Files",
                    "url": "https://en.wikipedia.org/wiki/Microsoft_Windows_library_files",
                    "description": "Wikipedia. (2017, January 31). Microsoft Windows library files. Retrieved February 13, 2017."
                }
            ],
            "x_mitre_deprecated": false,
            "revoked": false,
            "description": "Adversaries may execute malicious payloads via loading shared modules. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows [Native API](https://attack.mitre.org/techniques/T1106) which is called from functions like <code>CreateProcess</code>, <code>LoadLibrary</code>, etc. of the Win32 API.(Citation: Wikipedia Windows Library Files)\n\nThe module loader can load DLLs:\n\n* via specification of the (fully-qualified or relative) DLL pathname in the IMPORT directory;\n    \n* via EXPORT forwarded to another DLL, specified with (fully-qualified or relative) pathname (but without extension);\n    \n* via an NTFS junction or symlink program.exe.local with the fully-qualified or relative pathname of a directory containing the DLLs specified in the IMPORT directory or forwarded EXPORTs;\n    \n* via <code>&#x3c;file name=\"filename.extension\" loadFrom=\"fully-qualified or relative pathname\"&#x3e;</code> in an embedded or external \"application manifest\". The file name refers to an entry in the IMPORT directory or a forwarded EXPORT.\n\nAdversaries may use this functionality as a way to execute arbitrary payloads on a victim system. For example, malware may execute share modules to load additional components or features.",
            "modified": "2022-04-19T20:31:10.657Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "name": "Shared Modules",
            "x_mitre_detection": "Monitoring DLL module loads may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances, since benign use of Windows modules load functions are common and may be difficult to distinguish from malicious behavior. Legitimate software will likely only need to load routine, bundled DLL modules or Windows system DLLs such that deviation from known module loads may be suspicious. Limiting DLL module loads to <code>%SystemRoot%</code> and <code>%ProgramFiles%</code> directories will protect against module loads from unsafe paths. \n\nCorrelation of other events with behavior surrounding module loads using API monitoring and suspicious DLLs written to disk will provide additional context to an event that may assist in determining if it is due to malicious behavior.",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-attack",
                    "phase_name": "execution"
                }
            ],
            "x_mitre_is_subtechnique": false,
            "x_mitre_data_sources": [
                "Module: Module Load",
                "Process: OS API Execution"
            ],
            "x_mitre_remote_support": false,
            "x_mitre_attack_spec_version": "2.1.0",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"
        }
    ]
}