Synopsis
Activation Period |
14 Days |
Training Period |
30 Days |
Test Period |
N/A (single event) |
Deduplication Period |
1 Day |
Required Data |
|
Detection Modules |
|
Detector Tags |
|
ATT&CK Tactic |
|
ATT&CK Technique |
|
Severity |
Medium |
Description
Attackers can modify ld.so.preload to inject malicious code into every dynamically linked process, enabling persistence and code execution. This detected operation is considered atypical in terms of access.
Attacker's Goals
This allows attackers to inject malicious code into system processes, gain persistence, code injection, evading detection, and potentially escalating privileges.
Investigative actions
- Check whether the executing process is benign, and if this was a desired behavior as part of its normal execution flow.
- Download the /etc/ld.so.preload file from the host and see if and what libraries are specified there.
- Download any library specified and see if it's benign.