Linux Code Injection via ld.so Preload File (/etc/ld.so.preload)

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1574.006Dynamic Linker Hijacking
Persistence
- T1574.006Dynamic Linker Hijacking
Priv Esc
- T1574.006Dynamic Linker Hijacking
Defense Evasion
- T1574.006Dynamic Linker Hijacking
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags attempts to establish code injection persistence by using the dynamic linker preload mechanism, specifically targeting the /etc/ld.so.preload file. Attackers abuse this to force attacker-controlled shared libraries to load into newly executed processes, enabling stealthy execution and potential privilege escalation. It relies on log entries that contain the literal path /etc/ld.so.preload.

Reporting behind it

Related detections8 linkedT1574.006 — drag to rearrange

Malicious Koske Userland Rootkit Installation via ld.so.preload (via file_event)

Malicious TeamTNT prochider Rootkit Deployment as Shared Object (via file_event)

Malicious perfctl Rootkit Library Drop via ld.so.preload (via file_event)

Malicious Shared Library Preload Persistence via ld.so.preload (via process_creation)

Malicious Userland Rootkit Persistence via ld.so.preload on Linux

Suspicious Bootkitty Rootkit Component Drop under opt via File System

Malicious LD_PRELOAD Rootkit Persistence via ld.so.preload

Linux: Detect Modification of /etc/ld.so.preload for Shared Object Injection

Linux Code Injection via ld.so Preload File (/etc/ld.so.preload)

Pivot detection · T1574.006 · 8 related

Changelog

v3

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-code-injection-via-ld-so-preload-file-etc-ld-so-preload-7e3c4651

title: Linux Code Injection via ld.so Preload File (/etc/ld.so.preload)
id: db1de77f-4ebb-4d2b-b7da-6dd33da13469
status: test
description: This rule flags attempts to establish code injection persistence by using the dynamic linker preload mechanism, specifically targeting the /etc/ld.so.preload file. Attackers abuse this to force attacker-controlled shared libraries to load into newly executed processes, enabling stealthy execution and potential privilege escalation. It relies on log entries that contain the literal path /etc/ld.so.preload.
references:
  - https://man7.org/linux/man-pages/man8/ld.so.8.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_ldso_preload_injection.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-05-05
modified: 2022-10-09
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.006
logsource:
  product: linux
detection:
  keywords:
    - /etc/ld.so.preload
  condition: keywords
falsepositives:
  - Rare temporary workaround for library misconfiguration
level: high
license: DRL-1.1
related:
  - id: 7e3c4651-c347-40c4-b1d4-d48590fdf684
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL