Code Injection by ld.so Preload File Modification
This rule detects the creation or modification of the `/etc/ld.so.preload` file. This file is used by the dynamic linker (`ld.so`) on Linux systems to specify shared libraries that should be loaded before any other libraries. Adversaries can leverage this mechanism for persistence, privilege escalation, or defense evasion by preloading malicious libraries, effectively hijacking legitimate functions. Refer to `man ld.so` for more details on its functionality.
Sigma
