Linux LD Audit or LD Debug Dynamic Linker Abuse

Danny Y@zendannyy

•updated Jun 3, 2026•3•0•7

Detects processes launched with LD_AUDIT or LD_DEBUG style dynamic linker instrumentation, sometimes used to weaken execution guardrails or enable stealthy code paths.