Detect Dynamic Linker Hijacking in Splunk
Adversaries hijack dynamic linker environment variables to load malicious shared libraries before legitimate system libraries. On Linux, the LD_PRELOAD environment variable causes the dynamic linker to load specified shared objects before all others, allowing function hooking. Attackers may also modify /etc/ld.so.preload to achieve system-wide persistence. On macOS, DYLD_INSERT_LIBRARIES provides equivalent functionality. Groups including APT41, Aquatic Panda, Rocke (cryptomining), and HiddenWasp/Symbiote have used LD_PRELOAD for persistence and rootkit-like behavior — hooking libc functions (execve, readdir) to hide processes and files. The Ebury SSH backdoor and COATHANGER (FortiGate backdoor) used this technique against production infrastructure.
MITRE ATT&CK
- Technique
- T1574 Hijack Execution Flow
- Sub-technique
- T1574.006 Dynamic Linker Hijacking
- Canonical reference
- https://attack.mitre.org/techniques/T1574/006/
SPL Detection Query
index=linux_logs OR index=syslog sourcetype="linux_secure" OR sourcetype=syslog
| eval CommandLine=coalesce(command, cmd, message)
| eval LDPreload=if(match(CommandLine, "LD_PRELOAD"), 1, 0)
| eval DYLDInsert=if(match(CommandLine, "DYLD_INSERT_LIBRARIES"), 1, 0)
| eval LDLibPath=if(match(CommandLine, "LD_LIBRARY_PATH"), 1, 0)
| where LDPreload=1 OR DYLDInsert=1 OR LDLibPath=1
| table _time, host, user, CommandLine, LDPreload, DYLDInsert, LDLibPath
| sort - _time
```
ALSO check /etc/ld.so.preload modifications:
```
index=linux_auditd sourcetype=linux:audit type=SYSCALL (syscall=open OR syscall=openat OR syscall=write)
| where match(msg_audit, "ld.so.preload")
| table _time, host, auid, uid, exe, msg_audit
| sort - _timeDetects LD_PRELOAD and DYLD_INSERT_LIBRARIES usage in Linux/macOS process command lines via syslog and auditd. The second subquery specifically monitors auditd syscall events for access to /etc/ld.so.preload — the system-wide preload file that causes every process to load the specified library. This file should almost never be modified in production systems.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Developer workstations using Valgrind, AddressSanitizer, or similar instrumentation tools
- Performance analysis workflows using profiling libraries injected via LD_PRELOAD
- CI/CD pipelines that use LD_PRELOAD for test instrumentation
- Some container runtimes and orchestration systems that set library paths
Other platforms for T1574.006
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Inspect /etc/ld.so.preload Contents
Expected signal: Auditd syscall events for open/read of /etc/ld.so.preload (if auditd is monitoring this path). Process creation events for ls and cat commands.
- Test 2Create Malicious LD_PRELOAD Library (Benign Test)
Expected signal: Process creation events for gcc and ls. The ls process will have LD_PRELOAD=/tmp/test_preload.so in its environment (visible in /proc/<pid>/environ). Auditd may log the library load. File creation event for test_preload.so in /tmp.
- Test 3Modify /etc/ld.so.preload for System-Wide Persistence (Test Only)
Expected signal: Auditd SYSCALL records for open+write on /etc/ld.so.preload with privileged account (sudo). File modification event captured by endpoint telemetry. The modification timestamp on /etc/ld.so.preload changes — forensically detectable.
References (6)
- https://attack.mitre.org/techniques/T1574/006/
- https://intezer.com/blog/research/new-linux-threat-symbiote/
- https://www.elastic.co/security-labs/declawing-pumakit
- https://www.man7.org/linux/man-pages/man8/ld.so.8.html
- https://www.welivesecurity.com/2017/10/30/windigo-ebury-update-2/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.006/T1574.006.md
Unlock Pro Content
Get the full detection package for T1574.006 including response playbook, investigation guide, and atomic red team tests.