Code Injection by ld.so Preload

Title: Code Injection by ld.so Preload
Status: test
Description:Detects the ld.so preload persistence file. See `man ld.so` for more information.
References:
  -https://man7.org/linux/man-pages/man8/ld.so.8.html
Author: Christian Burkard (Nextron Systems)
Date: 2021-05-05
modified:2022-10-09
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1574.006'

Logsource:

• product: linux

Detection:
  keywords:
    - '/etc/ld.so.preload'
  condition:keywords
Falsepositives:
  -Rare temporary workaround for library misconfiguration
Level: high