huntrule

Malicious LD_PRELOAD Rootkit Persistence via ld.so.preload

PremiumReviewedSigma · High · v1
Product
linux
Category
process_creation
Author
HuntRule
Published
2026-05-26
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects a command writing the OVERSTEP shared object into /etc/ld.so.preload to hook every dynamically linked process on a SonicWall SMA appliance. This LD_PRELOAD rootkit hides attacker files and processes while capturing credentials, cementing long-term stealthy access after public-facing exploitation.

Reporting behind it

Related detections9 linkedT1014 — drag to rearrange
Malicious ld.so.preload Hijack Loading libcext by Auto-Color (via process_creation)
Malicious Koske Userland Rootkit Installation via ld.so.preload (via file_event)
Malicious TeamTNT prochider Rootkit Deployment as Shared Object (via file_event)
Malicious perfctl Rootkit Library Drop via ld.so.preload (via file_event)
Malicious Userland Rootkit Persistence via ld.so.preload on Linux
Suspicious Loading of Malicious Netfilter Kernel Module for Traffic Signaling
Malicious Kernel Driver Load from User AppData Directory
Malicious ld.so.preload Persistence Modification on Ivanti Connect Secure (via file_event)
Malicious Kernel Driver Service Registration for ProjectConfiguration Rootkit
Malicious LD_PRELOAD Rootkit Persistence via ld.so.preload
Pivot detection · T1014 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.