Unusual process access to ld.so.preload file
Synopsis
Activation Period
14 Days
Training Period
30 Days
Test Period
N/A (single event)
Deduplication Period
1 Day
Required Data
XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK Tactic
Execution (TA0002)
ATT&CK Technique
Hijack Execution Flow: Dynamic Linker Hijacking (T1574.006)
Severity
Medium
Description
Attackers can modify ld.so.preload to inject malicious code into every dynamically linked process, enabling persistence and code execution. This detected operation is considered atypical in terms of access.
Attacker's Goals
This allows attackers to inject malicious code into system processes, gain persistence, code injection, evade detection, and potentially escalate privileges.
Investigative actions
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
Download the /etc/ld.so.preload file from the host and see if and what libraries are specified there.
Download any library specified and see if it's benign.
Was this helpful?