huntrule

Suspicious LD_PRELOAD Library Injection via PUMAKIT Userland Rootkit

PremiumReviewedSigma · Medium · v1
Product
linux
Category
process_creation
Author
HuntRule
Published
2026-07-10
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects a process launched with the LD_PRELOAD environment variable pointing at a shared object under a system library path which the PUMAKIT userland rootkit uses to hook standard library calls and hide its presence. Adversaries preload a malicious shared object to intercept functions for stealth and persistence.

Reporting behind it

Related detections9 linkedT1014 — drag to rearrange
Malicious ld.so.preload Hijack Loading libcext by Auto-Color (via process_creation)
Suspicious Loading of Malicious Netfilter Kernel Module for Traffic Signaling
Malicious Kernel Driver Load from User AppData Directory
Malicious Kernel Driver Service Registration for ProjectConfiguration Rootkit
Suspicious Execution or Load from Fake System32 Directory Imprint (via process_creation)
Malicious Vulnerable Driver Mapping via KDU
Suspicious Kernel Module Load From World Writable Directory on Linux
Suspicious Kernel Module Load Or Unload For Rootkit Deployment via PUMAKIT
Suspicious Fileless Execution From Memory File Descriptor via PUMAKIT
Suspicious LD_PRELOAD Library Injection via PUMAKIT Userland Rootkit
Pivot detection · T1014 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.