huntrule

Malicious perfctl Rootkit Library Drop via ld.so.preload (via file_event)

PremiumReviewedSigma · High · v1
Product
linux
Category
file_event
Author
HuntRule
Published
2026-09-06
Updated
2026-09-06
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the perfctl malware dropping its LD_PRELOAD rootkit and fake system libraries that hook pam_authenticate and pcap_loop to hide activity and steal credentials. It fires when the libgcwrap.so rootkit or the decoy libpprocps.so and libfsnkdev.so libraries are written to disk. These filenames are specific to the perfctl campaign.

Reporting behind it

Related detections9 linkedT1014 — drag to rearrange
Malicious Koske Userland Rootkit Installation via ld.so.preload (via file_event)
Malicious TeamTNT prochider Rootkit Deployment as Shared Object (via file_event)
Malicious Userland Rootkit Persistence via ld.so.preload on Linux
Malicious LD_PRELOAD Rootkit Persistence via ld.so.preload
Malicious Shared Library Preload Persistence via ld.so.preload (via process_creation)
Suspicious Bootkitty Rootkit Component Drop under opt via File System
Malicious VoidLink Rootkit Dropper Artifacts via Filesystem (via file_event)
Suspicious LD_PRELOAD Library Injection via PUMAKIT Userland Rootkit
Malicious VoidLink Pinned eBPF Map in BPF Filesystem (via file_event)
Malicious perfctl Rootkit Library Drop via ld.so.preload (via file_event)
Pivot detection · T1014 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.