Linux Code Injection via ld.so Preload File (/etc/ld.so.preload)

Alerts on references to /etc/ld.so.preload, indicating possible dynamic-library injection persistence on Linux.

FreeUnreviewedSigmahighv1

linux-code-injection-via-ld-so-preload-file-etc-ld-so-preload-7e3c4651

title: Linux Code Injection via ld.so Preload File (/etc/ld.so.preload)
id: db1de77f-4ebb-4d2b-b7da-6dd33da13469
status: test
description: This rule flags accesses or events containing the path /etc/ld.so.preload, which can be used to force the dynamic loader to load attacker-controlled shared libraries for all newly launched processes. Attackers use ld.so preload to achieve persistent code execution and potential privilege escalation while blending into normal program startup behavior. It relies on Linux telemetry that records the presence of the specific file path in events or logs.
references:
  - https://man7.org/linux/man-pages/man8/ld.so.8.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_ldso_preload_injection.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-05-05
modified: 2022-10-09
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.006
logsource:
  product: linux
detection:
  keywords:
    - /etc/ld.so.preload
  condition: keywords
falsepositives:
  - Rare temporary workaround for library misconfiguration
level: high
license: DRL-1.1
related:
  - id: 7e3c4651-c347-40c4-b1d4-d48590fdf684
    type: derived

What it detects

This rule flags accesses or events containing the path /etc/ld.so.preload, which can be used to force the dynamic loader to load attacker-controlled shared libraries for all newly launched processes. Attackers use ld.so preload to achieve persistent code execution and potential privilege escalation while blending into normal program startup behavior. It relies on Linux telemetry that records the presence of the specific file path in events or logs.

Known false positives

Rare temporary workaround for library misconfiguration

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.