domains / families / security / macos-process-injection

macos-process-injection

separate

macOS process injection playbook. Use when you need to inject code into running or launching macOS processes via dylib hijacking, DYLD environment variables, XPC exploitation, Mach port manipulation, or Electron/Chromium abuse.

When to use

• DYLD_INSERT_LIBRARIES injection
• dylib hijacking
• weak dylib hijacking
• @rpath hijacking
• dylib proxying
• XPC exploitation
• Mach port manipulation
• Electron injection

When not to use

• bypassing TCC, Gatekeeper, or SIP protections
• Unix-layer privilege escalation

Skill page

Source