Detectionhightest

Modification of ld.so.preload

Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitrary code into processes.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.communityCreated Thu Oct 24Updated Sat Nov 274b3cb710-5e83-4715-8c45-8b2b5b3e5751linux

Log Source

Linuxauditd

ProductLinux← raw: linux

Serviceauditd← raw: auditd

Detection Logic

detection:
    selection:
        type: 'PATH'
        name: '/etc/ld.so.preload'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

4b3cb710-5e83-4715-8c45-8b2b5b3e5751

Status

test

Level

high

Type

Detection

Created

Thu Oct 24

Modified

Sat Nov 27

Author

Path

rules/linux/auditd/path/lnx_auditd_ld_so_preload_mod.yml

Raw Tags

attack.privilege-escalationattack.persistenceattack.defense-evasionattack.t1574.006