Linux LD_AUDIT/LD_DEBUG Environment Variable Usage

nomit vyas@xoxo

•updated Apr 30, 2026•0•47

This rule detects the use of specific Linux environment variables (LD_AUDIT, LD_DEBUG, LD_DEBUG_OUTPUT) in command lines. These variables can be abused for dynamic-link library (DLL) injection or other forms of process injection, allowing adversaries to execute arbitrary code or debug processes in a way that might bypass security controls.