huntrule

Malicious ld.so.preload Overwrite for Privilege Escalation via PostgreSQL Escape (via file_event)

PremiumReviewedSigma · High · v1
Product
linux
Category
file_event
Author
HuntRule
Published
2026-11-04
Updated
2026-11-04
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects modification of the dynamic linker preload file /etc/ld.so.preload, which the PostgreSQL managed-database escape chain overwrote to load an attacker library into privileged processes on GCP Cloud SQL hosts. Writes to this file are almost never legitimate and indicate an attempt to hijack execution and escalate to root.

Reporting behind it

Related detections9 linkedT1574.006 — drag to rearrange
Suspicious Linux Dynamic Linker Hijacking via LD_PRELOAD or ld.so.preload (via process_creation)
Malicious ld.so.preload Hijack Loading libcext by Auto-Color (via process_creation)
Malicious ld.so.preload Persistence Modification on Ivanti Connect Secure (via file_event)
Suspicious Dynamic Linker Hijacking via ld.so.preload Modification
Malicious Koske Userland Rootkit Installation via ld.so.preload (via file_event)
Malicious TeamTNT prochider Rootkit Deployment as Shared Object (via file_event)
Malicious perfctl Rootkit Library Drop via ld.so.preload (via file_event)
Malicious Shared Library Preload Persistence via ld.so.preload (via process_creation)
Malicious Userland Rootkit Persistence via ld.so.preload on Linux
Malicious ld.so.preload Overwrite for Privilege Escalation via PostgreSQL Escape (via file_event)
Pivot detection · T1574.006 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.