Restrict Library Loading

Restricting library loading involves implementing security controls to ensure that only trusted and verified libraries (DLLs, shared objects, etc.) are loaded into processes. Adversaries often abuse Dynamic-Link Library (DLL) Injection, DLL Search Order Hijacking, or LD_PRELOAD mechanisms to execute malicious code by forcing the operating system to load untrusted libraries. This mitigation can be implemented through the following measures:

Enforce Safe Library Loading Practices:

• Enable SafeDLLSearchMode on Windows.
• Restrict LD_PRELOAD and LD_LIBRARY_PATH usage on Linux systems.

Code Signing Enforcement:

• Require digital signatures for all libraries loaded into processes.
• Use tools like Signtool, and WDAC to enforce signed DLL execution.

Environment Hardening:

• Secure library paths and directories to prevent adversaries from placing rogue libraries.
• Monitor user-writable directories and system configurations for unauthorized changes.

Audit and Monitor Library Loading:

• Enable Sysmon on Windows to monitor for suspicious library loads.
• Use auditd on Linux to monitor shared library paths and configuration file changes.

Use Application Control Solutions:

• Implement AppLocker, WDAC, or SELinux to allow only trusted libraries.

Tools for Implementation

Windows-Specific Tools:

• AppLocker: Application whitelisting for DLLs.
• Windows Defender Application Control (WDAC): Restrict unauthorized library execution.
• Signtool: Verify and enforce code signing.
• Sysmon: Monitor DLL load events (Event ID 7).

Linux-Specific Tools:

• auditd: Monitor changes to library paths and critical files.
• SELinux/AppArmor: Define policies to restrict library loading.
• ldconfig and chattr: Secure LD configuration files and prevent unauthorized modifications.

Cross-Platform Solutions:

• Wazuh or OSSEC: File integrity monitoring for library changes.
• Tripwire: Detect and alert on unauthorized library modifications.

1. Επισκόπηση

1.1 Παραπομπές

1.2 Εντοπισμένες απαιτήσεις

1.3 Σχετικοί κανονισμοί

2. Εντοπισμένες απαιτήσεις

3. Σχετικοί κανονισμοί

Συνδεδεμένα ζητήματα

• MITREATTACK -

  EN: MITRE ATT&CK®, https://attack.mitre.org/. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. License: The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. See the Terms of Use for the disclaimers. ATT&CK® is a registered trademark of The MITRE Corporation. Converted into the GRCA format.

  DE: MITRE ATT&CK®, https://attack.mitre.org/. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE erlaubt die Nutzung für Forschung, Entwicklung und kommerzielle Zwecke, wenn jede Kopie den Urheberrechtsvermerk und die Lizenz enthält; maßgeblich ist der englische Wortlaut der Lizenz oben und die Terms of Use mit den Haftungsausschlüssen. ATT&CK® ist eine eingetragene Marke der MITRE Corporation. In das GRCA-Format umgewandelt.