huntrule

Suspicious Dynamic Linker Hijacking via ld.so.preload Modification

PremiumReviewedSigma · Medium · v1
Product
linux
Category
process_creation
Author
HuntRule
Published
2026-09-18
Updated
2026-09-18
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects command line activity that writes to the /etc/ld.so.preload file, a dynamic linker hijacking mechanism detailed in Elastic Linux persistence research. By adding a malicious shared object to ld.so.preload the attacker forces it to load into every dynamically linked process for stealthy persistence and privilege abuse. Modifications to this global preload file are rarely legitimate and warrant investigation.

Reporting behind it

Related detections9 linkedT1574.006 — drag to rearrange
Malicious Koske Userland Rootkit Installation via ld.so.preload (via file_event)
Malicious TeamTNT prochider Rootkit Deployment as Shared Object (via file_event)
Malicious perfctl Rootkit Library Drop via ld.so.preload (via file_event)
Malicious Shared Library Preload Persistence via ld.so.preload (via process_creation)
Malicious Userland Rootkit Persistence via ld.so.preload on Linux
Suspicious Bootkitty Rootkit Component Drop under opt via File System
Malicious LD_PRELOAD Rootkit Persistence via ld.so.preload
Linux Code Injection via ld.so Preload File (/etc/ld.so.preload)
Linux: Detect Modification of /etc/ld.so.preload for Shared Object Injection
Suspicious Dynamic Linker Hijacking via ld.so.preload Modification
Pivot detection · T1574.006 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.