Linux Process with LD_DEBUG Env Variables

Danny Y@zendannyy

•updated Apr 26, 2026•1•0•244

This rule detects the execution of a Linux process where the command line contains environment variables related to dynamic linker debugging (LD_AUDIT, LD_DEBUG, or LD_DEBUG_OUTPUT). These variables can be abused by adversaries to load malicious libraries, bypass security controls.