Auditd dynamic linker config modified
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Goal
Detect modifications to /etc/ld.so.preload, a file used by the Linux dynamic linker to preload shared libraries for every process. Attackers abuse this file to inject malicious libraries system-wide, enabling privilege escalation or persistent code execution.
Strategy
This rule correlates two auditd events sharing the same event_id: a PATH record showing /etc/ld.so.preload was accessed, and a SYSCALL record for an openat call (File System Activity, Read). Requiring both records reduces false positives from unrelated file reads.
Triage and response
- Identify the process that opened
/etc/ld.so.preload using {{@ocsf.actor.process.path}} and {{@ocsf.actor.process.name}} from the correlated SYSCALL record. - Review the current contents of
/etc/ld.so.preload on host {{host}} to determine if a malicious library path was written. - Check when the file was last modified (
stat /etc/ld.so.preload) and correlate with surrounding process and authentication logs. - If unauthorized, remove the malicious entry, terminate any processes that preloaded the library, and investigate the initial access vector.
