T1574.006 Dynamic Linker Hijacking

Reports

No published report maps this technique in its ATT&CK table; it is carried by detection rules only.

Detection rules

Rules whose ATT&CK coverage line names this technique, by detection page. The link opens the page's coverage table.

Detection rules Jun 2026 · 4 rules

Multi-Actor AI-Agent Framework Abuse (8 Operators)

libpam_cache LD_PRELOAD Rootkit Family Signature (YARA, Detection); GHOST Kit Installer Function Signatures (ghost.sh) (YARA, Detection); /etc/ld.so.preload Modification (LD_PRELOAD Rootkit Persistence) (SIGMA, Detection); Cryptojacker libpam_cache Drop to /lib/security (SIGMA, Detection)

Detection rules May 2026 · 10 rules

GHOST Cryptojacker Kit — Vova75Rus Supply Chain (77.110.96.200)

MAL_Linux_GHOST_libpam_cache_Rootkit_Family (YARA, Detection); MAL_Linux_GHOST_libpam_cache_Source (YARA, Detection); MAL_Linux_GHOST_Kit_Shell_Installer (YARA, Detection); MAL_Linux_GHOST_ComfyUI_Fake_PerformanceMonitor_Node (YARA, Hunting); Linux LD_PRELOAD Persistence File Modification (SIGMA, Detection); Suspicious Shared Library Created in PAM Security Directory (SIGMA, Detection); Auditd - PAM Security Library Directory Write by Non-Package-Manager (SIGMA, Detection); Chattr Immutable Bit Set on Linux Persistence Target Paths (SIGMA, Detection); Suspicious LD_PRELOAD Set to Non-Standard Library Path (SIGMA, Hunting); GHOST Kit Distribution File Download from AEZA Hosting Range (SURICATA, Detection)

Tracked actors

Designations whose reports map this technique.

UTA-2026-016: GHOST cryptojacker kit customer (operator A) with self-hosted mining pool proxies
UTA-2026-017: GHOST cryptojacker kit customer (operator B) using public mining pools, host abandoned

ATT&CK v19.2. MITRE ATT&CK® is a registered trademark of The MITRE Corporation; technique names are MITRE's and link to MITRE's own pages. The mapping on each linked page is this publication's reading of its own evidence.