huntrule

Linux Code Injection via ld.so Preload File (/etc/ld.so.preload)

Alerts on references to /etc/ld.so.preload, indicating possible dynamic-library injection persistence on Linux.

FreeReviewedSigma · High · v3
Product
linux
Author
Christian Burkard (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-05-05
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags attempts to establish code injection persistence by using the dynamic linker preload mechanism, specifically targeting the /etc/ld.so.preload file. Attackers abuse this to force attacker-controlled shared libraries to load into newly executed processes, enabling stealthy execution and potential privilege escalation. It relies on log entries that contain the literal path /etc/ld.so.preload.

Reporting behind it

Related detections8 linkedT1574.006 — drag to rearrange
Malicious Koske Userland Rootkit Installation via ld.so.preload (via file_event)
Malicious TeamTNT prochider Rootkit Deployment as Shared Object (via file_event)
Malicious perfctl Rootkit Library Drop via ld.so.preload (via file_event)
Malicious Shared Library Preload Persistence via ld.so.preload (via process_creation)
Malicious Userland Rootkit Persistence via ld.so.preload on Linux
Suspicious Bootkitty Rootkit Component Drop under opt via File System
Malicious LD_PRELOAD Rootkit Persistence via ld.so.preload
Linux: Detect Modification of /etc/ld.so.preload for Shared Object Injection
Linux Code Injection via ld.so Preload File (/etc/ld.so.preload)
Pivot detection · T1574.006 · 8 related

Changelog

v3
  1. v3
    Candidate ingested via manual entry.2026-07-31
  2. v2
    Candidate ingested via manual entry.2026-07-31
  3. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.