Unusual process access to ld.so.preload file

Analytics BIOC Medium

Unusual process access to ld.so.preload file

Attackers can modify ld.so.preload to inject malicious code into every dynamically linked process, enabling persistence and code execution. This detected operation is considered atypical in terms of access.

Module:: Platform Analytics
Data source:: XDR Agent with eXtended Threat Hunting (XTH)

ATT&CK tactics: Persistence (TA0003)

ATT&CK techniques: Hijack Execution Flow: Dynamic Linker Hijacking (T1574.006)

Attacker's goals:

This allows attackers to inject malicious code into system processes, gain persistence, code injection, evade detection, and potentially escalate privileges.

Investigative actions:

Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow. Download the /etc/ld.so.preload file from the host and see if and what libraries are specified there. Download any library specified and see if it's benign.

Test period:: N/A (single event)
Deduplication:: 1 Day