Modification of ld.so.preload

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•22

This rule identifies modifications to the `/etc/ld.so.preload` file. This file is used by the Linux dynamic linker to specify shared libraries that should be loaded before any other libraries. Attackers can modify this file to inject malicious shared objects into processes, enabling privilege escalation, persistence, or defense evasion by loading arbitrary code.