Linux ld.so.preload File Modification for Shared Object Injection

title: Linux ld.so.preload File Modification for Shared Object Injection
id: d11b8f41-3eee-4950-97ce-3e7bf5d76224
status: test
description: This rule identifies changes to /etc/ld.so.preload, which controls where the dynamic loader looks for shared objects to preload into processes. Attackers can abuse this to force arbitrary code to load during process startup, enabling stealthy persistence or execution across multiple programs. The detection relies on Linux auditd PATH telemetry that records file access events involving /etc/ld.so.preload.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.006/T1574.006.md
  - https://eqllib.readthedocs.io/en/latest/analytics/fd9b987a-1101-4ed3-bda6-a70300eaf57e.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/path/lnx_auditd_ld_so_preload_mod.yml
author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community, Huntrule Team
date: 2019-10-24
modified: 2021-11-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.006
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: PATH
    name: /etc/ld.so.preload
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 4b3cb710-5e83-4715-8c45-8b2b5b3e5751
    type: derived