Linux: Detect Modification of /etc/ld.so.preload for Shared Object Injection

Flags auditd activity where /etc/ld.so.preload is modified, indicating potential shared object injection.

FreeReviewedSigma · High · v3

Product: linux
Service: auditd
Author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community (SigmaHQ), DRL 1.1
Published: 2019-10-24
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1574.006Dynamic Linker Hijacking
Persistence
- T1574.006Dynamic Linker Hijacking
Priv Esc
- T1574.006Dynamic Linker Hijacking
Defense Evasion
- T1574.006Dynamic Linker Hijacking
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags events where the file /etc/ld.so.preload is modified, indicating an attempt to influence dynamic library loading. Attackers can abuse this path to have arbitrary shared objects loaded into subsequently started processes, enabling code execution, persistence, and stealth. It relies on Linux auditd telemetry capturing file modification activity with type=PATH and name=/etc/ld.so.preload.

Reporting behind it

Related detections8 linkedT1574.006 — drag to rearrange

Malicious Koske Userland Rootkit Installation via ld.so.preload (via file_event)

Malicious TeamTNT prochider Rootkit Deployment as Shared Object (via file_event)

Malicious perfctl Rootkit Library Drop via ld.so.preload (via file_event)

Malicious Shared Library Preload Persistence via ld.so.preload (via process_creation)

Malicious Userland Rootkit Persistence via ld.so.preload on Linux

Suspicious Bootkitty Rootkit Component Drop under opt via File System

Malicious LD_PRELOAD Rootkit Persistence via ld.so.preload

Linux Code Injection via ld.so Preload File (/etc/ld.so.preload)

Linux: Detect Modification of /etc/ld.so.preload for Shared Object Injection

Pivot detection · T1574.006 · 8 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-ld-so-preload-file-modification-for-shared-object-injection-4b3cb710

title: "Linux: Detect Modification of /etc/ld.so.preload for Shared Object Injection"
id: d11b8f41-3eee-4950-97ce-3e7bf5d76224
status: test
description: This rule flags events where the file /etc/ld.so.preload is modified, indicating an attempt to influence dynamic library loading. Attackers can abuse this path to have arbitrary shared objects loaded into subsequently started processes, enabling code execution, persistence, and stealth. It relies on Linux auditd telemetry capturing file modification activity with type=PATH and name=/etc/ld.so.preload.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.006/T1574.006.md
  - https://eqllib.readthedocs.io/en/latest/analytics/fd9b987a-1101-4ed3-bda6-a70300eaf57e.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/path/lnx_auditd_ld_so_preload_mod.yml
author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community, Huntrule Team
date: 2019-10-24
modified: 2021-11-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.006
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: PATH
    name: /etc/ld.so.preload
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 4b3cb710-5e83-4715-8c45-8b2b5b3e5751
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL