T1574.006Dynamic Linker Hijacking
T1574.006 — Dynamic Linker Hijacking is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 8 detection use cases covering it and 3 threat-intel articles citing it.
Defense EvasionExecution
8Use cases
3Articles
0Sub-techniques
2Tactics
↑ Parent technique: T1574 · Hijack Execution Flow
Use cases covering this technique (8)
GitHub Workflow File Creation or Modification Linux Auditd Preload Hijack Library Calls Linux Auditd Preload Hijack Via Preload File Linux Preload Hijack Library Calls Shai-Hulud Workflow File Creation or Modification [LLM] Node extraction writing ld.so.preload or setuid/privileged path as root (CVE-2026-53486 privesc) [LLM] sshd loads compromised liblzma.so.5.6.0 / 5.6.1 (CVE-2024-3094 runtime trigger) [LLM] PwnKit GCONV_PATH artifact directory/file creationArticles citing this technique (3)
crit The XZ backdoor CVE-2024-3094 art-1369