All Detections

Modification of ld.so.preload

avatar
SigmaHQ Detections@sigmaHQ
updated Apr 28, 2026000

Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitrary code into processes.

Sigma