Dynamic Linker LD_PRELOAD Hijack via SSH

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to hijack the dynamic linker's LD_PRELOAD mechanism over an SSH connection. It specifically looks for the string "LD_PRELOAD" within TCP traffic on port 22 (SSH). This technique is often used by attackers for persistence or privilege escalation by injecting malicious libraries into legitimate processes.