TLDR Tech / InfoSec
Detecting (Evil) Dylibs
This post details how attackers utilize macOS dynamic library (dylib) injection to inherit a host process's trust, entitlements, and TCC grants while blinding native security tools. By employing techniques such as DYLD_INSERT_LIBRARIES injection, @rpath hijacking, or trojanizing libraries, threat actors can bypass System Integrity Protection (SIP) and achieve deep persistence. To close this process-level blind spot, the post recommends that security tools statically parse Mach-O LC_LOAD_DYLIB commands for collisions, dynamically enumerate loaded libraries, and subscribe to Endpoint Security's ES_EVENT_TYPE_AUTH_MMAP to intercept malicious dylibs before they map into memory.
Read the full story