Detect Dynamic Linker Hijacking in Microsoft Sentinel
Adversaries hijack dynamic linker environment variables to load malicious shared libraries before legitimate system libraries. On Linux, the LD_PRELOAD environment variable causes the dynamic linker to load specified shared objects before all others, allowing function hooking. Attackers may also modify /etc/ld.so.preload to achieve system-wide persistence. On macOS, DYLD_INSERT_LIBRARIES provides equivalent functionality. Groups including APT41, Aquatic Panda, Rocke (cryptomining), and HiddenWasp/Symbiote have used LD_PRELOAD for persistence and rootkit-like behavior — hooking libc functions (execve, readdir) to hide processes and files. The Ebury SSH backdoor and COATHANGER (FortiGate backdoor) used this technique against production infrastructure.
MITRE ATT&CK
- Technique
- T1574 Hijack Execution Flow
- Sub-technique
- T1574.006 Dynamic Linker Hijacking
- Canonical reference
- https://attack.mitre.org/techniques/T1574/006/
KQL Detection Query
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has "LD_PRELOAD" or ProcessCommandLine has "DYLD_INSERT_LIBRARIES" or ProcessCommandLine has "LD_LIBRARY_PATH"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
| union (
DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName == "ld.so.preload" or FolderPath == "/etc"
| where ActionType in ("FileCreated", "FileModified")
| where FileName == "ld.so.preload"
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, FileName, FolderPath,
InitiatingProcessFileName, ActionType
)
| sort by Timestamp descDetects dynamic linker hijacking via two primary methods: (1) processes launched with LD_PRELOAD or DYLD_INSERT_LIBRARIES environment variables in their command line, and (2) modification of the /etc/ld.so.preload file which applies LD_PRELOAD system-wide for all processes. Both indicators are high-fidelity signals of attempted library injection. The /etc/ld.so.preload modification is particularly serious as it affects every process on the system.
Data Sources
Required Tables
False Positives & Tuning
- Memory leak detection tools like Valgrind and AddressSanitizer that use LD_PRELOAD for instrumentation
- Performance profiling tools (perf, gprof wrappers) that inject profiling libraries via LD_PRELOAD
- Java and JVM-based applications that may set LD_LIBRARY_PATH to find JNI libraries
- Legitimate security tools that use LD_PRELOAD for system call interception (e.g., some EDR agents)
Other platforms for T1574.006
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Inspect /etc/ld.so.preload Contents
Expected signal: Auditd syscall events for open/read of /etc/ld.so.preload (if auditd is monitoring this path). Process creation events for ls and cat commands.
- Test 2Create Malicious LD_PRELOAD Library (Benign Test)
Expected signal: Process creation events for gcc and ls. The ls process will have LD_PRELOAD=/tmp/test_preload.so in its environment (visible in /proc/<pid>/environ). Auditd may log the library load. File creation event for test_preload.so in /tmp.
- Test 3Modify /etc/ld.so.preload for System-Wide Persistence (Test Only)
Expected signal: Auditd SYSCALL records for open+write on /etc/ld.so.preload with privileged account (sudo). File modification event captured by endpoint telemetry. The modification timestamp on /etc/ld.so.preload changes — forensically detectable.
References (6)
- https://attack.mitre.org/techniques/T1574/006/
- https://intezer.com/blog/research/new-linux-threat-symbiote/
- https://www.elastic.co/security-labs/declawing-pumakit
- https://www.man7.org/linux/man-pages/man8/ld.so.8.html
- https://www.welivesecurity.com/2017/10/30/windigo-ebury-update-2/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.006/T1574.006.md
Unlock Pro Content
Get the full detection package for T1574.006 including response playbook, investigation guide, and atomic red team tests.