Discover weak Dylib loads with missing Dylibs

Scan all running processes and check for instances of LC_LOAD_WEAK_DYLIB that are missing the underlying Dylib.
View Command

To view this TTPs command, you must be logged in with a professional or enterprise license.


Test this TTP

Download Operator (1.7.1)
Test this TTP using one of our Operator chains
JXA Modules


Use JXA to create a fully modular file-less implant that dynamically resolves and load modules at runtime.